CVEs published by Drupal.org

CVEs published by Drupal.org (CVE Numbering Authority). 72 tracked.

• CVE-2026-96376 MEDIUM 6.4 Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Dr
• CVE-2026-96355 CRITICAL 9.1 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows C
• CVE-2026-84920 MEDIUM 5.3 Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing
• CVE-2026-87942 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal S
• CVE-2026-87940 MEDIUM 5.4 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting I
• CVE-2026-87939 MEDIUM 4.2 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal F
• CVE-2026-87937 MEDIUM 6.5 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS
• CVE-2026-87936 MEDIUM 6.5 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal a
• CVE-2026-84924 MEDIUM 5.4 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal E
• CVE-2026-84923 MEDIUM 6.5 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Veri
• CVE-2026-84921 MEDIUM 5.3 Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing
• CVE-2026-84919 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal P
• CVE-2026-84918 LOW 3.7 Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature
• CVE-2026-84917 MEDIUM 6.5 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing
• CVE-2026-84916 LOW 3.7 Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing
• CVE-2026-84915 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal C
• CVE-2026-84914 MEDIUM 5.3 Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing
• CVE-2026-81163 MEDIUM 5.4 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media L
• CVE-2026-16648 LOW 3.8 Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Service
• CVE-2026-87951 LOW 3.8 Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve
• CVE-2026-87950 MEDIUM 5.3 Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Se
• CVE-2026-87949 LOW 3.3 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal S
• CVE-2026-87948 LOW 3.5 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal S
• CVE-2026-87947 MEDIUM 4.8 Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows S
• CVE-2026-87946 MEDIUM 4.8 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force
• CVE-2026-87945 MEDIUM 5.4 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allow
• CVE-2026-87944 MEDIUM 4.8 Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the M
• CVE-2026-87943 MEDIUM 6.5 Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing
• CVE-2026-96365 HIGH 7.5 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocati
• CVE-2026-96386 MEDIUM 6.5 Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing
• CVE-2026-96356 MEDIUM 5.3 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing
• CVE-2026-96366 MEDIUM 5.3 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing
• CVE-2026-96385 MEDIUM 6.5 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authenticatio
• CVE-2026-96380 MEDIUM 6.5 Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing
• CVE-2026-96364 MEDIUM 5.3 Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse
• CVE-2026-96377 MEDIUM 5.3 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Exces
• CVE-2026-96370 MEDIUM 5.4 Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery
• CVE-2026-96372 MEDIUM 5.4 Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing
• CVE-2026-96375 MEDIUM 4.8 Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM)
• CVE-2026-96371 MEDIUM 5.4 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS
• CVE-2026-96378 MEDIUM 4.3 Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerc
• CVE-2026-96358 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal W
• CVE-2026-96361 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal W
• CVE-2026-96367 MEDIUM 4.6 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS
• CVE-2026-96368 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal W
• CVE-2026-96388 MEDIUM 5.4 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Re
• CVE-2026-87954 MEDIUM 4.3 Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing
• CVE-2026-96357 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal W
• CVE-2026-96359 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal W
• CVE-2026-96398 MEDIUM 4.3 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing
• CVE-2026-84912 MEDIUM 4.6 Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing
• CVE-2026-84913 MEDIUM 4.6 Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing
• CVE-2026-96382 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal D
• CVE-2026-84910 MEDIUM 4.2 Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing
• CVE-2026-96362 MEDIUM 4.2 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal W
• CVE-2026-96384 LOW 3.5 Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing
• CVE-2026-96387 LOW 3.8 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allo
• CVE-2026-96390 MEDIUM 4.3 Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privile
• CVE-2026-96374 MEDIUM 4.2 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery
• CVE-2026-87952 LOW 3.1 Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Ser
• CVE-2026-96360 LOW 3.5 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal W
• CVE-2026-96369 LOW 3.1 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting In
• CVE-2026-87953 LOW 3.3 Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Req
• CVE-2026-96373 LOW 3.3 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing
• CVE-2026-96392 LOW 3.5 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allo
• CVE-2026-84911 LOW 3.1 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal A
• CVE-2026-96363 HIGH n/a Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS
• CVE-2026-96391 HIGH n/a Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing
• CVE-2026-87938 HIGH n/a Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal C
• CVE-2026-87941 HIGH n/a Vulnerability in Drupal Patreon
• CVE-2026-96379 HIGH n/a Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal C
• CVE-2026-87955 MEDIUM 4.3 Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing

← Back to latest CVEs