Skip to contentDrupal vulnerabilities
Products
Show 46 moreShow less
Newest
- drupal material iconsMaterial Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011CVE-2026-3210Fix available5.3 Medium
- beyris ui iconsUI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010CVE-2026-2349Fix available6.1 Medium
- drupal quick editQuick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009CVE-2026-2348Fix available5.4 Medium
- budda login disableLogin Disable - Less critical - Access bypass - SA-CONTRIB-2026-008CVE-2026-1917Fix available4.3 Medium
- drupal, silence form builder +1 moreCross-Site Scripting Vulnerability in Drupal Form Builder ModuleCVE-2026-0749Fix available4.8 Medium
- drupal commerce payboxPayment bypass in Commerce PayboxCVE-2026-0750Fix available8.7 High
- drupal central authentication system (cas) server, jtenman central authentication system server +1 moreCentral Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007CVE-2026-1554Fix available4.2 Medium
- drupal canvasDrupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-006CVE-2026-1553Fix available4.8 Medium
- drupal facebook pixel, facebook pixel project pixel +1 moreXSS in Drupal 7 Facebook Pixel ModuleCVE-2025-14557Fix available4.8 Medium
- drupal flagXSS in Drupal 7 Flag ModuleCVE-2025-14556Fix available4.8 Medium
- drupal microsoft entra id sso loginMicrosoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-005CVE-2026-0948Fix available6.5 Medium
- bordeaux-metropole at internet piano analyticsAT Internet Piano Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-004CVE-2026-0947Fix available4.8 Medium
- bordeaux-metropole at internet smarttagAT Internet SmartTag - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-003CVE-2026-0946Fix available6.1 Medium
- drupal role delegation, role delegation project delegation +1 moreRole Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-002CVE-2026-0945Fix available8.8 High
- drupal group inviteGroup invite - Moderately critical - Access bypass - SA-CONTRIB-2026-001CVE-2026-0944Fix available5.3 Medium
- bmeme http client managerHTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-126CVE-2025-14840Fix available7.5 High
- acquia content hub, drupal acquia content hub +1 moreAcquia Content Hub - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-125CVE-2025-14472Fix available8.1 High
- drupal disable login pageDisable Login Page - Critical - Access bypass - SA-CONTRIB-2025-124CVE-2025-13986Fix available4.2 Medium
- drupal entity shareEntity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123CVE-2025-13985Fix available5.3 Medium
- drupal next.jsNext.js - Critical - Access bypass - SA-CONTRIB-2025-122CVE-2025-13984Fix available6.1 Medium
- drupal tagifyTagify - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-121CVE-2025-13983Fix available5.4 Medium
- drupal login time restrictionLogin Time Restriction - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-120CVE-2025-13982Fix available8.1 High
- artificial intelligence project intelligence, drupal ai (artificial intelligence) +1 moreAI (Artificial Intelligence) - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-119CVE-2025-13981Fix available4.4 Medium
- cksource ckeditor 5 premium featuresCKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118CVE-2025-13980Fix available5.3 Medium
- drupal mini siteMini site - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-117CVE-2025-13979Fix available5.4 Medium
- drupal, webform multiple file upload project multiple file upload +1 moreXSS vulnerability when rendering filename in Webform MultiformCVE-2025-12848Fix available7.0 High
- drupal, drupal core +1 moreDrupal core - Moderately critical - Information disclosure - SA-CORE-2025-008CVE-2025-13083Fix available3.7 Low
- drupal, drupal core +1 moreDrupal core - Moderately critical - Defacement - SA-CORE-2025-007CVE-2025-13082Fix available4.3 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget chain - SA-CORE-2025-006CVE-2025-13081Fix available5.9 Medium
- drupal simple multi step form, simple multi step form project multi step form +1 moreSimple multi step form - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-116CVE-2025-12761Fix available3.5 Low
- drupal email tfa, email tfa project tfa +1 moreEmail TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-115CVE-2025-12760Fix available5.4 Medium
- drupal simple oauth (oauth2) & openid connect, simple oauth project oauth +1 moreSimple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass - SA-CONTRIB-2025-114CVE-2025-12466Fix available7.5 High
- drupal civictheme design systemCivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113CVE-2025-12083Fix available6.1 Medium
- drupal civictheme design systemCivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-112CVE-2025-12082Fix available7.5 High
- drupal reverse proxy header, reverse proxy header project proxy header +1 moreReverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111CVE-2025-10929Fix available5.3 Medium
- 2bits currencyCurrency - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-110CVE-2025-10930Fix available4.3 Medium
- drupal umami analytics, umami analytics +1 moreUmami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109CVE-2025-10931Fix available3.8 Low
- access code project code, drupal access code +1 moreAccess code - Moderately critical - Access bypass - SA-CONTRIB-2025-108CVE-2025-10928Fix available6.3 Medium
- drupal plausible tracking, plausible tracking project tracking +1 morePlausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107CVE-2025-10927Fix available6.1 Medium
- drupal json field, json field project field +1 moreJSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106CVE-2025-10926Fix available6.1 Medium
- acquia dam, drupal acquia dam +1 moreAcquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105CVE-2025-9954Fix available7.5 High
- drupal owl carousel 2, owl carousel 2 project carousel 2 +1 moreOwl Carousel 2 - Critical - Unsupported - SA-CONTRIB-2025-104CVE-2025-95545.3 Medium
- api key manager project key manager, drupal api key manager +1 moreAPI Key manager - Critical - Unsupported - SA-CONTRIB-2025-103CVE-2025-95535.3 Medium
- drupal synchronize composer.json with contrib modules, synchronize composer.json with contrib modules project composer.json with contrib modules +1 moreSynchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102CVE-2025-95525.3 Medium
- drupal protected pages, protected pages project pages +1 moreProtected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101CVE-2025-9551Fix available6.5 Medium
- drupal facetsFacets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100CVE-2025-9550Fix available6.1 Medium
- drupal facetsFacets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099CVE-2025-9549Fix available6.5 Medium
- authenticator login project login, drupal authenticator login +1 moreAuthenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098CVE-2025-8093Fix available8.8 High
- drupal layout builder advanced permissions, layout builder advanced permissions project builder advanced permissions +1 moreLayout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097CVE-2025-89964.3 Medium
- authenticator login project login, drupal authenticator login +1 moreAuthenticator Login - Highly critical - Access bypass - SA-CONTRIB-2025-096CVE-2025-8995Fix available9.8 Critical
- Show moreLoading…