Drupal vulnerabilities and fixes

CVEs that mention Drupal, ranked by priority. 72 tracked.

Drupal has 72 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 9. Most recent: 2026-10-22. Highest priority: CVE-2026-96355 (score 46/100).

• CVE-2026-96355 CRITICAL 9.1 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows C
• CVE-2026-96365 HIGH 7.5 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocati
• CVE-2026-96376 MEDIUM 6.4 Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Dr
• CVE-2026-84923 MEDIUM 6.5 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Veri
• CVE-2026-96386 MEDIUM 6.5 Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing
• CVE-2026-87936 MEDIUM 6.5 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal a
• CVE-2026-87937 MEDIUM 6.5 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS
• CVE-2026-84917 MEDIUM 6.5 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing
• CVE-2026-87943 MEDIUM 6.5 Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing
• CVE-2026-96356 MEDIUM 5.3 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing
• CVE-2026-96366 MEDIUM 5.3 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing
• CVE-2026-96385 MEDIUM 6.5 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authenticatio
• CVE-2026-84921 MEDIUM 5.3 Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing
• CVE-2026-96380 MEDIUM 6.5 Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing
• CVE-2026-84920 MEDIUM 5.3 Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing
• CVE-2026-87950 MEDIUM 5.3 Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Se
• CVE-2026-96364 MEDIUM 5.3 Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse
• CVE-2026-96377 MEDIUM 5.3 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Exces
• CVE-2026-84914 MEDIUM 5.3 Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing
• CVE-2026-87946 MEDIUM 4.8 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force
• CVE-2026-96370 MEDIUM 5.4 Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery
• CVE-2026-96372 MEDIUM 5.4 Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing
• CVE-2026-81163 MEDIUM 5.4 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media L
• CVE-2026-87944 MEDIUM 4.8 Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the M
• CVE-2026-87947 MEDIUM 4.8 Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows S
• CVE-2026-96375 MEDIUM 4.8 Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM)
• CVE-2026-84924 MEDIUM 5.4 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal E
• CVE-2026-87940 MEDIUM 5.4 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting I
• CVE-2026-96371 MEDIUM 5.4 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS
• CVE-2026-84916 LOW 3.7 Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing
• CVE-2026-87945 MEDIUM 5.4 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allow
• CVE-2026-96378 MEDIUM 4.3 Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerc
• CVE-2026-96358 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal W
• CVE-2026-96361 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal W
• CVE-2026-96367 MEDIUM 4.6 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS
• CVE-2026-96368 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal W
• CVE-2026-96388 MEDIUM 5.4 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Re
• CVE-2026-84918 LOW 3.7 Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature
• CVE-2026-87954 MEDIUM 4.3 Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing
• CVE-2026-96357 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal W
• CVE-2026-96359 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal W
• CVE-2026-96398 MEDIUM 4.3 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing
• CVE-2026-84912 MEDIUM 4.6 Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing
• CVE-2026-84913 MEDIUM 4.6 Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing
• CVE-2026-84915 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal C
• CVE-2026-84919 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal P
• CVE-2026-87942 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal S
• CVE-2026-87955 MEDIUM 4.3 Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing
• CVE-2026-96382 MEDIUM 4.6 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal D
• CVE-2026-84910 MEDIUM 4.2 Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing
• CVE-2026-87939 MEDIUM 4.2 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal F
• CVE-2026-96362 MEDIUM 4.2 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal W
• CVE-2026-96384 LOW 3.5 Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing
• CVE-2026-96387 LOW 3.8 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allo
• CVE-2026-96390 MEDIUM 4.3 Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privile
• CVE-2026-16648 LOW 3.8 Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Service
• CVE-2026-87951 LOW 3.8 Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve
• CVE-2026-96374 MEDIUM 4.2 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery
• CVE-2026-87948 LOW 3.5 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal S
• CVE-2026-87952 LOW 3.1 Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Ser
• CVE-2026-96360 LOW 3.5 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal W
• CVE-2026-96369 LOW 3.1 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting In
• CVE-2026-87949 LOW 3.3 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal S
• CVE-2026-87953 LOW 3.3 Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Req
• CVE-2026-96373 LOW 3.3 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing
• CVE-2026-96392 LOW 3.5 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allo
• CVE-2026-84911 LOW 3.1 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal A
• CVE-2026-96363 HIGH n/a Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS
• CVE-2026-96391 HIGH n/a Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing
• CVE-2026-87938 HIGH n/a Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal C
• CVE-2026-87941 HIGH n/a Vulnerability in Drupal Patreon
• CVE-2026-96379 HIGH n/a Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal C

FAQ

How do I fix Drupal vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Drupal being exploited right now?

None of the tracked Drupal CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Drupal CVE should I patch first?

CVE-2026-96355 currently ranks highest (46/100): Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows C.

← Back to latest CVEs