Skip to contentDrupal vulnerabilities
Products
Show 46 moreShow less
Newest
- anuaralfetahe advanced content feedback, drupal advanced content feedback (aka admin feedback) +1 moreAdvanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051CVE-2026-13231Fix available6.1 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Improper validation - SA-CORE-2026-009CVE-2026-55808Fix available5.4 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008CVE-2026-55807Fix available3.1 Low
- drupal, drupal core +1 moreDrupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007CVE-2026-55806Fix available5.9 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget chain - SA-CORE-2026-006CVE-2026-55804Fix available5.9 Medium
- drupal, drupal core +1 moreDrupal core - Critical - PHP object injection - SA-CORE-2026-005CVE-2026-55803Fix available5.9 Medium
- drupal plotly.js graphingPlotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050CVE-2026-55810Fix available8.1 High
- drupal flag attendance field, flag attendance field project attendance field +1 moreFlag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049CVE-2026-55809Fix available8.1 High
- drupal formatter fieldFormatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048CVE-2026-12535Fix available9.8 Critical
- drupal brute force attack protectionBrute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047CVE-2026-119155.9 Medium
- composerComposer - Critical - Unsupported - SA-CONTRIB-2026-046CVE-2026-119145.9 Medium
- drupal mother may iMother May I - Critical - Unsupported - SA-CONTRIB-2026-045CVE-2026-119139.8 Critical
- drupal examples for developersExamples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044CVE-2026-11909Fix available3.3 Low
- drupal tagifyTagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043CVE-2026-11908Fix available5.4 Medium
- cleantalk anti-spam, drupal anti-spam by cleantalk +1 moreAnti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042CVE-2026-10770Fix available6.1 Medium
- centarro commerce coreCommerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041CVE-2026-10769Fix available5.4 Medium
- drupal localgov workflowsLocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039CVE-2026-10768Fix available9.8 Critical
- drupal tfa basic plugins, tfa basic plugins project basic plugins +1 moreTFA Basic Plugins - Access BypassCVE-2026-6816Fix available5.1 Medium
- alternativecommerce, drupal alternativecommerce (basket) +1 moreDrupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038CVE-2026-9726Fix available9.8 Critical
- drupal term reference tree, taxonomy term reference tree widget project term reference tree widget +1 moreStored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels)CVE-2026-4093Fix available5.1 Medium
- drupal simple hierarchical select (shs), simple hierarchical select project hierarchical select +1 moreSimple Hierarchical Select (Drupal 7) XSS in term-derived outputCVE-2026-4929Fix available5.1 Medium
- date ical project ical, drupal date ical +1 moreDate iCal - Critical - Information disclosure - SA-CONTRIB-2026-037CVE-2026-8495Fix available9.8 Critical
- colorbox inline project inline, drupal colorbox inline +1 moreColorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036CVE-2026-8493Fix available5.4 Medium
- drupal translate drupal with gtranslate, gtranslate +1 moreTranslate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035CVE-2026-8492Fix available2.7 Low
- adcisolutions node view permissionsNode View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034CVE-2026-8491Fix available3.7 Low
- drupal obfuscateObfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033CVE-2026-6871Fix available6.1 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003CVE-2026-6367Fix available6.1 Medium
- boscop-fr orejimeOrejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032CVE-2026-6095Fix available6.1 Medium
- drupal saml sso - service providerSAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031CVE-2026-5343Fix available7.4 High
- internationalization project internationalization, drupal internationalization (i18n) - i18n node submodule +1 moreAccess bypass in Drupal 7 i18n_node translation UICVE-2026-0748Fix available5.3 Medium
- drupal file (field) paths, deciphered filefield paths +1 moreInformation disclosure via file URI overwrite in File (Field) PathsCVE-2026-1556Fix available6.9 Medium
- ajk automated logoutAutomated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030CVE-2026-4393Fix available4.3 Medium
- drupal unpublished node permissionsUnpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029CVE-2026-4933Fix available7.5 High
- artificial intelligence project intelligence, drupal ai (artificial intelligence) +1 moreAI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028CVE-2026-3573Fix available7.5 High
- drupal openid connect / oauth client, bojanz openid connect \/ oauth client +1 moreOpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027CVE-2026-3532Fix available4.2 Medium
- drupal openid connect / oauth client, bojanz openid connect \/ oauth client +1 moreOpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026CVE-2026-3531Fix available6.5 Medium
- drupal openid connect / oauth client, bojanz openid connect \/ oauth client +1 moreOpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025CVE-2026-3530Fix available4.3 Medium
- drupal google analytics ga4Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024CVE-2026-3529Fix available6.1 Medium
- drupal calculation fieldsCalculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023CVE-2026-3528Fix available6.1 Medium
- ceriumsoft ajax dashboardAJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022CVE-2026-3527Fix available6.5 Medium
- drupal file access fix (deprecated), geeks4change file access fix +1 moreFile Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021CVE-2026-3526Fix available5.3 Medium
- drupal file access fix (deprecated), geeks4change file access fix +1 moreFile Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020CVE-2026-3525Fix available5.3 Medium
- drupal responsive faviconsResponsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019CVE-2026-3218Fix available4.8 Medium
- drupal saml sso - service providerSAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018CVE-2026-3217Fix available6.1 Medium
- drupal canvasDrupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017CVE-2026-3216Fix available5.0 Medium
- drupal islandoraIslandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016CVE-2026-3215Fix available5.4 Medium
- arnabdotorg captchaCAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015CVE-2026-3214Fix available6.5 Medium
- cleantalk anti-spam, drupal anti-spam by cleantalk +1 moreAnti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014CVE-2026-3213Fix available4.7 Medium
- drupal tagifyTagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013CVE-2026-3212Fix available5.4 Medium
- drupal theme negotiation by rulesTheme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012CVE-2026-3211Fix available4.3 Medium
- Show moreLoading…