Drupal vulnerabilities

Products

• Drupal 281
• Core 62
• Core 21
• Webform 20
• Ai (artificial Intelligence) 18
• Saml Sso - Service Provider 13
• Open Social 8
• Commerce Core 7
• Enterprise Mfa - Tfa For Drupal 6
• Project Issue Tracking Module 6
• Print 5
• Aggregation Module 4
• Cookies Consent Management 4
• Canvas 4
• Everyblog 4
• Monster Menus 4
• Project 4
• Two-factor Authentication (tfa) 4
• Ubercart Module 4
• Anti-spam By Cleantalk 3
• Authenticator Login 3
• Captcha 3
• Commerce Stripe 3
• Content Construction Kit 3
• Disable Login Page 3
• Project Issue Tracking 3
• Facets 3
• Gammu Sms Daemon 3
• Login Disable 3
• One Time Password 3
• Openid Connect / Oauth Client 3
• Persistent Login 3
• Shindig-integrator 3
• Single Content Sync 3
• Tagify 3
• Ui Icons 3
• Access Code 2
• Acquia Dam 2
• Activity 2
• Advanced Content Feedback (aka Admin Feedback) 2

Show 66 moreShow less

• Ai Agents 2
• Ajax Checklist 2
• At Internet Smarttag 2
• Authenticator Login Plus (2fa) 2
• Bibliography Module 2
• Block Attributes 2
• Brilliant Gallery 2
• Central Authentication System (cas) Server 2
• Chatroom Module 2
• Civictheme Design System 2
• Cloud 2
• Colorbox 2
• Commerce Shipping 2
• Cookies Consent Management 2
• Custom Search Module 2
• Data 2
• Database Administration Module 2
• Data Field 2
• Data-module 2
• Diff 2
• Core 2
• Easylinks Module 2
• Eca: Event - Condition - Action 2
• Email Tfa 2
• Email Verification / Sms Verification / Otp Verification 2
• Examples For Developers 2
• Fasttoggle 2
• Field Permissions 2
• File Access Fix (deprecated) 2
• File Entity (fieldable Files) 2
• Flag 2
• Flowdrop 2
• Freelinking 2
• Frontend Editing 2
• Google Tag 2
• Gutenberg 2
• Help Tip Module 2
• Imce Module 2
• Islandora 2
• Klaro Cookie & Consent Management 2
• Localization Client 2
• Logintoboggan Module 2
• Matomo Analytics 2
• Media Alias Display 2
• Node Access Rebuild Progressive 2
• Obfuscate 2
• Paragraphs 2
• Paragraphs Table 2
• Photoswipe - Responsive Javascript Modal Image Gallery 2
• Post File 2
• Quick Node Block 2
• Restful Web Services 2
• Restrict Route By Ip 2
• Screenshot 2
• Secure Site Module 2
• Simple Klaro 2
• Simple Oauth (oauth2) & Openid Connect 2
• Stage File Proxy 2
• Swiper Formatter 2
• Talk 2
• Taxonomy Autotagger Module 2
• Trailscout Module 2
• Unpublished Node Permissions 2
• User Karma Module 2
• Views 2
• Webform Rest 2

Newest

• drupal file force download File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers CVE-2026-110176 8.7 HighOctober 31, 2026
• drupal field collection for drupal 7 Field Collection for Drupal 7 access bypass via missing parent entity access check CVE-2026-77152 5.3 MediumOctober 30, 2026
• drupal doccheck basic DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237 CVE-2026-114539 No scoreOctober 30, 2026
• drupal media alias display Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292 CVE-2026-118571 Fix available No scoreOctober 28, 2026
• drupal content sync (content-sync.io) Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291 CVE-2026-118568 Fix available No scoreOctober 28, 2026
• drupal oauth2 token manager OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290 CVE-2026-118573 Fix available No scoreOctober 28, 2026
• drupal field permissions Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289 CVE-2026-118584 Fix available No scoreOctober 28, 2026
• drupal field permissions Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288 CVE-2026-118583 Fix available No scoreOctober 28, 2026
• drupal openid connect client OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287 CVE-2026-118554 Fix available No scoreOctober 28, 2026
• drupal stage file proxy Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286 CVE-2026-118576 Fix available No scoreOctober 28, 2026
• drupal signature pad widget Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285 CVE-2026-118575 Fix available No scoreOctober 28, 2026
• drupal oauth login - oauth oidc sso OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284 CVE-2026-118572 Fix available No scoreOctober 28, 2026
• drupal bulk update user roles Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280 CVE-2026-118567 Fix available No scoreOctober 28, 2026
• drupal s3 file system S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279 CVE-2026-118574 Fix available No scoreOctober 28, 2026
• drupal fasttoggle Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283 CVE-2026-118570 Fix available No scoreOctober 28, 2026
• drupal fasttoggle Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282 CVE-2026-118569 Fix available No scoreOctober 28, 2026
• drupal captcha CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281 CVE-2026-118582 Fix available No scoreOctober 28, 2026
• drupal groupex pro ( daxko ) integration GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278 CVE-2026-118565 No scoreOctober 28, 2026
• drupal payumoney for drupal commerce PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277 CVE-2026-118564 No scoreOctober 28, 2026
• drupal cacheflush CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276 CVE-2026-118563 No scoreOctober 28, 2026
• drupal single content sync Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275 CVE-2026-118562 Fix available No scoreOctober 28, 2026
• drupal single content sync Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274 CVE-2026-118561 Fix available No scoreOctober 28, 2026
• drupal ai (artificial intelligence) AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273 CVE-2026-118553 Fix available No scoreOctober 28, 2026
• drupal ai (artificial intelligence) AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272 CVE-2026-118552 Fix available No scoreOctober 28, 2026
• drupal ai (artificial intelligence) AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271 CVE-2026-118551 Fix available No scoreOctober 28, 2026
• drupal ai (artificial intelligence) AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270 CVE-2026-118550 Fix available No scoreOctober 28, 2026
• drupal ai (artificial intelligence) AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269 CVE-2026-118549 Fix available No scoreOctober 28, 2026
• drupal ai (artificial intelligence) AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268 CVE-2026-118548 Fix available No scoreOctober 28, 2026
• drupal ai (artificial intelligence) AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267 CVE-2026-118546 Fix available No scoreOctober 28, 2026
• drupal ai (artificial intelligence) AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266 CVE-2026-118545 Fix available No scoreOctober 28, 2026
• drupal commerce stripe Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265 CVE-2026-118560 Fix available No scoreOctober 28, 2026
• drupal commerce stripe Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264 CVE-2026-118559 Fix available No scoreOctober 28, 2026
• drupal commerce stripe Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263 CVE-2026-118558 Fix available No scoreOctober 28, 2026
• drupal commerce shipping Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262 CVE-2026-118557 Fix available No scoreOctober 28, 2026
• drupal commerce shipping Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261 CVE-2026-118556 Fix available No scoreOctober 28, 2026
• drupal commerce license Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260 CVE-2026-118555 Fix available No scoreOctober 28, 2026
• drupal commerce core Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259 CVE-2026-118544 Fix available No scoreOctober 28, 2026
• drupal commerce core Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258 CVE-2026-118543 Fix available No scoreOctober 28, 2026
• drupal commerce core Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257 CVE-2026-118542 Fix available No scoreOctober 28, 2026
• drupal commerce core Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256 CVE-2026-118541 Fix available No scoreOctober 28, 2026
• drupal commerce core Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255 CVE-2026-118540 Fix available No scoreOctober 28, 2026
• drupal commerce core Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 CVE-2026-118539 Fix available 6.5 MediumOctober 28, 2026
• drupal patreon Patreon - Critical - Unsupported - SA-CONTRIB-2026-139 CVE-2026-87941 5.9 MediumOctober 22, 2026
• drupal monster menus Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253 CVE-2026-114573 Fix available No scoreOctober 21, 2026
• drupal rabbit hole Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252 CVE-2026-114571 Fix available No scoreOctober 21, 2026
• drupal ai file to text AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251 CVE-2026-114554 Fix available No scoreOctober 21, 2026
• drupal data field Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250 CVE-2026-114555 Fix available 3.5 LowOctober 21, 2026
• drupal domain login restrict Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249 CVE-2026-114572 Fix available 5.4 MediumOctober 21, 2026
• codeigniter4 shield Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248 CVE-2026-107256 Fix available No scoreOctober 21, 2026
• drupal imageapi optimize webp ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247 CVE-2026-114548 Fix available No scoreOctober 21, 2026
• Show olderLoading…