Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-110176File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers
- CVE-2026-77152Field Collection for Drupal 7 access bypass via missing parent entity access check
- CVE-2026-107249Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192
- CVE-2026-107250ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193
- CVE-2026-107251Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194
- CVE-2026-107252MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195
- CVE-2026-107253Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196
- CVE-2026-107254Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197
- CVE-2026-107257Actstream - Critical - Access bypass - SA-CONTRIB-2026-198
- CVE-2026-107258Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199
- CVE-2026-107259Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200
- CVE-2026-107261Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201
- CVE-2026-107263Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202
- CVE-2026-107264Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203
- CVE-2026-107265Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204
- CVE-2026-107266Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205
- CVE-2026-96389Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206
- CVE-2026-107268Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207
- CVE-2026-107267DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208
- CVE-2026-107306Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209
- CVE-2026-107307SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210
- CVE-2026-107308Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211
- CVE-2026-107309Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212
- CVE-2026-107310Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213
- CVE-2026-107311Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214
- CVE-2026-107312Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215
- CVE-2026-107255Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216
- CVE-2026-107262Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217
- CVE-2026-108097Drupal core - Critical - Remote code execution - SA-CORE-2026-014
- CVE-2026-110738Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219