CVE Intelligence

Vulnerabilidades de Drupal

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Drupal: 138 registro(s), com severidade, exploração e correções.

Drupal 22Drupal core 16Drupal Canvas 4AI (Artificial Intelligence) 4OpenID Connect / OAuth client 3Tagify 3Facets 2SAML SSO - Service Provider 2File Access Fix (deprecated) 2Paragraphs 2FlowDrop 2Anti-Spam by CleanTalk 2Login Disable 2CivicTheme Design System 2AI Agents 2Advanced Content Feedback (aka admin feedback) 2Commerce Core 1Umami Analytics 1Drupal AlternativeCommerce (Basket) 1Flag 1LocalGov Workflows 1Facebook Pixel 1API Key manager 1Protected Pages 1Synchronize composer.json With Contrib Modules 1JSON Field 1Reverse Proxy Header 1Currency 1Simple OAuth (OAuth2) & OpenID Connect 1Authenticator Login 1Email TFA 1Plausible tracking 1Commerce guest registration 1ECA: Event - Condition - Action 1Clean RESTful 1Raw Formatter [Meta Tag Formatter] 1Brute force attack protection 1Composer 1Mother May I 1Colorbox 1

Somente exploradas (KEV) →

CVE-2026-15079 Média · 5.4 CWE-307 10/07/2026
Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.
CVE-2026-13244 Alta · 8.1 CWE-915 10/07/2026
Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.
CVE-2026-13243 Média · 4.8 CWE-352 10/07/2026
Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.
CVE-2026-13242 Média · 6.5 CWE-89 10/07/2026
Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.
CVE-2026-13241 Média · 6.5 CWE-862 10/07/2026
Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
CVE-2026-13240 Média · 6.5 CWE-862 10/07/2026
Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
CVE-2026-13239 Média · 6.5 CWE-862 10/07/2026
WissKI - Critical - Access bypass - SA-CONTRIB-2026-059
Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.
CVE-2026-13238 Média · 4.8 CWE-863 10/07/2026
Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058
Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payments versions: from 0.0.0 to 3.0.2.
CVE-2026-13237 Média · 4.8 CWE-863 10/07/2026
AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057
Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.
CVE-2026-13236 Média · 4.2 CWE-862 10/07/2026
AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056
Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.
CVE-2026-13235 Baixa · 3.3 CWE-862 10/07/2026
AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.
CVE-2026-13234 Média · 6.1 CWE-79 10/07/2026
AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.
CVE-2026-13233 Baixa · 3.3 CWE-918 10/07/2026
OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053
Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.
CVE-2026-13232 Baixa · 3.1 CWE-863 10/07/2026
Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052
Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.
CVE-2026-13231 Média · 6.1 CWE-79 10/07/2026
Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Stored XSS. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.
CVE-2026-12535 Crítica · 9.8 CWE-915 10/07/2026
Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.
CVE-2026-11909 Baixa · 3.3 CWE-862 10/07/2026
Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044
Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6.
CVE-2026-11908 Média · 5.4 CWE-79 10/07/2026
Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagify versions: from 0.0.0 to 1.2.52.
CVE-2026-10770 Média · 6.1 CWE-79 10/07/2026
Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.
CVE-2026-10769 Média · 5.4 CWE-79 10/07/2026
Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.
CVE-2026-10768 Crítica · 9.8 CWE-862 10/07/2026
LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039
Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.
CVE-2026-9726 Crítica · 9.8 CWE-915 10/07/2026
Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.
CVE-2026-6816 Baixa · 3.8 CWE-267 28/05/2026
TFA Basic Plugins - Access Bypass
An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.
CVE-2026-5343 Alta · 7.4 CWE-754 28/05/2026
SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4.
CVE-2026-4929 Média · 5.4 CWE-79 21/05/2026
Simple Hierarchical Select (Drupal 7) XSS in term-derived output
Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths include field formatter output (shs_field_formatter_view) and term-tree child-term data generation (shs_term_get_children). Malicious taxonomy term names can be rendered unsafely depending on output context. This affects versions from 7.x-1.0 through (and including) 7.x-1.10.