Vulnerabilidades de Drupal
CVEs publicadas que afetam produtos de Drupal: 138 registro(s), com severidade, exploração e correções.
Drupal 22Drupal core 16Drupal Canvas 4AI (Artificial Intelligence) 4OpenID Connect / OAuth client 3Tagify 3Facets 2SAML SSO - Service Provider 2File Access Fix (deprecated) 2Paragraphs 2FlowDrop 2Anti-Spam by CleanTalk 2Login Disable 2CivicTheme Design System 2AI Agents 2Advanced Content Feedback (aka admin feedback) 2Commerce Core 1Umami Analytics 1Drupal AlternativeCommerce (Basket) 1Flag 1LocalGov Workflows 1Facebook Pixel 1API Key manager 1Protected Pages 1Synchronize composer.json With Contrib Modules 1JSON Field 1Reverse Proxy Header 1Currency 1Simple OAuth (OAuth2) & OpenID Connect 1Authenticator Login 1Email TFA 1Plausible tracking 1Commerce guest registration 1ECA: Event - Condition - Action 1Clean RESTful 1Raw Formatter [Meta Tag Formatter] 1Brute force attack protection 1Composer 1Mother May I 1Colorbox 1
CVE-2026-3217
Média · 6.1
CWE-79 25/03/2026
SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.
CVE-2026-3216
Média · 5.0
CWE-918 25/03/2026
Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017
Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.
CVE-2026-3215
Média · 5.4
CWE-79 25/03/2026
Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scripting (XSS).This issue affects Islandora: from 0.0.0 before 2.17.5.
CVE-2026-3214
Média · 6.5
CWE-288 25/03/2026
CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 before 1.17.0, from 2.0.0 before 2.0.10.
CVE-2026-3213
Média · 4.7
CWE-79 25/03/2026
Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting (XSS).This issue affects Anti-Spam by CleanTalk: from 0.0.0 before 9.7.0.
CVE-2026-3212
Média · 5.4
CWE-79 25/03/2026
Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.
CVE-2026-3211
Média · 4.3
CWE-352 25/03/2026
Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1.
CVE-2026-3210
Média · 5.3
CWE-863 25/03/2026
Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011
Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4.
CVE-2026-2349
Média · 6.1
CWE-79 25/03/2026
UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1.
CVE-2026-2348
Média · 5.4
CWE-79 25/03/2026
Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Quick Edit allows Cross-Site Scripting (XSS).This issue affects Quick Edit: from 0.0.0 before 1.0.5, from 2.0.0 before 2.0.1.
CVE-2026-1917
Média · 4.3
CWE-288 25/03/2026
Login Disable - Less critical - Access bypass - SA-CONTRIB-2026-008
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Login Disable allows Functionality Bypass.This issue affects Login Disable: from 0.0.0 before 2.1.3.
CVE-2026-1554
Média · 4.2
CWE-91 04/02/2026
Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007
XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.
CVE-2026-1553
Média · 4.8
CWE-863 04/02/2026
Drupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-006
Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4.
CVE-2026-0948
Média · 6.5
CWE-288 04/02/2026
Microsoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-005
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects Microsoft Entra ID SSO Login: from 0.0.0 before 1.0.4.
CVE-2026-0947
Média · 4.8
CWE-79 04/02/2026
AT Internet Piano Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-004
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 before 2.3.1.
CVE-2026-0946
Média · 6.1
CWE-79 04/02/2026
AT Internet SmartTag - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-003
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XSS).This issue affects AT Internet SmartTag: from 0.0.0 before 1.0.1.
CVE-2026-0945
Alta · 8.8
CWE-267 04/02/2026
Role Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-002
Privilege Defined With Unsafe Actions vulnerability in Drupal Role Delegation allows Privilege Escalation.This issue affects Role Delegation: from 1.3.0 before 1.5.0.
CVE-2026-0944
Média · 5.3
CWE-754 04/02/2026
Group invite - Moderately critical - Access bypass - SA-CONTRIB-2026-001
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Group invite allows Forceful Browsing.This issue affects Group invite: from 0.0.0 before 2.3.9, from 3.0.0 before 3.0.4, from 4.0.0 before 4.0.4.
CVE-2025-14840
Alta · 7.5
CWE-754 28/01/2026
HTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-126
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects HTTP Client Manager: from 0.0.0 before 9.3.13, from 10.0.0 before 10.0.2, from 11.0.0 before 11.0.1.
CVE-2025-14472
Alta · 8.1
CWE-352 28/01/2026
Acquia Content Hub - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-125
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0.0 before 3.6.4, from 3.7.0 before 3.7.3.
CVE-2025-13986
Média · 4.2
CWE-288 28/01/2026
Disable Login Page - Critical - Access bypass - SA-CONTRIB-2025-124
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.
CVE-2025-13985
Média · 5.3
CWE-863 28/01/2026
Entity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123
Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0.
CVE-2025-13984
Média · 6.1
CWE-942 28/01/2026
Next.js - Critical - Access bypass - SA-CONTRIB-2025-122
Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.
CVE-2025-13983
Média · 5.4
CWE-79 28/01/2026
Tagify - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-121
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.44.
CVE-2025-13982
Alta · 8.1
CWE-352 28/01/2026
Login Time Restriction - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-120
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: from 0.0.0 before 1.0.3.