Vulnerabilidades de Drupal
CVEs publicadas que afetam produtos de Drupal: 180 registro(s), com severidade, exploração e correções.
Drupal 22Drupal core 19AI (Artificial Intelligence) 4Drupal Canvas 4Tagify 3Disable Login Page 3OpenID Connect / OAuth client 3Gammu SMS Daemon 3Anti-Spam by CleanTalk 2CivicTheme Design System 2Facets 2Login Disable 2SAML SSO - Service Provider 2File Access Fix (deprecated) 2Advanced Content Feedback (aka admin feedback) 2AI Agents 2Paragraphs 2FlowDrop 2Screenshot 2UI Icons 1Internationalization (i18n) - i18n node submodule 1Responsive Favicons 1Theme Negotiation by Rules 1Google Analytics GA4 1Access code 1Acquia DAM 1Owl Carousel 2 1HTTP Client Manager 1Drupal Commerce Paybox 1Mini site 1CKEditor 5 Premium Features 1Login Time Restriction 1Next.js 1Entity Share 1Acquia Content Hub 1Quick Edit 1Translate Drupal with GTranslate 1Date iCal 1Node View Permissions 1Colorbox Inline 1
CVE-2026-6366
Média · 6.6
CWE-915 19/05/2026
Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.
This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.
CVE-2026-6365
Média · 6.1
CWE-79 19/05/2026
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).
This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.
CVE-2026-6095
Média · 6.1
CWE-79 19/05/2026
Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS).
This issue affects Orejime: from 0.0.0 before 2.0.16.
CVE-2026-1556
Média · 6.5
CWE-200 26/03/2026
Information disclosure via file URI overwrite in File (Field) Paths
Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files.
CVE-2026-0748
Média · 4.3
CWE-276 26/03/2026
Access bypass in Drupal 7 i18n_node translation UI
In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs.
Exploit affects versions 7.x-1.0 up to and including 7.x-1.35.
CVE-2026-4933
Alta · 7.5
CWE-863 26/03/2026
Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029
Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing.This issue affects Unpublished Node Permissions: from 0.0.0 before 1.7.0.
CVE-2026-4393
Média · 4.3
CWE-352 26/03/2026
Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.2.
CVE-2026-3573
Alta · 7.5
CWE-863 26/03/2026
AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028
Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.1.11, from 1.2.0 before 1.2.12.
CVE-2026-3532
Média · 4.2
CWE-178 26/03/2026
OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027
Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.
CVE-2026-3531
Média · 6.5
CWE-288 26/03/2026
OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.
CVE-2026-3530
Média · 4.3
CWE-918 26/03/2026
OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025
Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.
CVE-2026-3529
Média · 6.1
CWE-79 26/03/2026
Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Analytics GA4 allows Cross-Site Scripting (XSS).This issue affects Google Analytics GA4: from 0.0.0 before 1.1.14.
CVE-2026-3528
Média · 6.1
CWE-79 26/03/2026
Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Calculation Fields allows Cross-Site Scripting (XSS).This issue affects Calculation Fields: from 0.0.0 before 1.0.4.
CVE-2026-3527
Média · 6.5
CWE-306 26/03/2026
AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022
Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Dashboard: from 0.0.0 before 3.1.0.
CVE-2026-3526
Média · 5.3
CWE-863 26/03/2026
File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021
Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.
CVE-2026-3525
Média · 5.3
CWE-863 26/03/2026
File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020
Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.
CVE-2026-3218
Média · 4.8
CWE-79 25/03/2026
Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (XSS).This issue affects Responsive Favicons: from 0.0.0 before 2.0.2.
CVE-2026-3217
Média · 6.1
CWE-79 25/03/2026
SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.
CVE-2026-3216
Média · 5.0
CWE-918 25/03/2026
Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017
Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.
CVE-2026-3215
Média · 5.4
CWE-79 25/03/2026
Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scripting (XSS).This issue affects Islandora: from 0.0.0 before 2.17.5.
CVE-2026-3214
Média · 6.5
CWE-288 25/03/2026
CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 before 1.17.0, from 2.0.0 before 2.0.10.
CVE-2026-3213
Média · 4.7
CWE-79 25/03/2026
Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting (XSS).This issue affects Anti-Spam by CleanTalk: from 0.0.0 before 9.7.0.
CVE-2026-3212
Média · 5.4
CWE-79 25/03/2026
Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.
CVE-2026-3211
Média · 4.3
CWE-352 25/03/2026
Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1.
CVE-2026-3210
Média · 5.3
CWE-863 25/03/2026
Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011
Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4.