# cve.now: Drupal The newest entries naming Drupal as an affected vendor (up to 200), of 576 in all, 4 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-110176](https://cve.now/CVE-2026-110176.md): File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers (CVSS 8.7) - [CVE-2026-77152](https://cve.now/CVE-2026-77152.md): Field Collection for Drupal 7 access bypass via missing parent entity access check (CVSS 5.3) - [CVE-2026-107249](https://cve.now/CVE-2026-107249.md): Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192 (CVSS 9.8) - [CVE-2026-107250](https://cve.now/CVE-2026-107250.md): ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193 (CVSS 5.9) - [CVE-2026-107251](https://cve.now/CVE-2026-107251.md): Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194 (CVSS 6.5) - [CVE-2026-107252](https://cve.now/CVE-2026-107252.md): MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195 (CVSS 5.4) - [CVE-2026-107253](https://cve.now/CVE-2026-107253.md): Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196 (CVSS 5.9) - [CVE-2026-107254](https://cve.now/CVE-2026-107254.md): Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197 (CVSS 4.8) - [CVE-2026-107257](https://cve.now/CVE-2026-107257.md): Actstream - Critical - Access bypass - SA-CONTRIB-2026-198 (CVSS 6.5) - [CVE-2026-107258](https://cve.now/CVE-2026-107258.md): Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199 (CVSS 5.4) - [CVE-2026-107259](https://cve.now/CVE-2026-107259.md): Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200 (CVSS 5.4) - [CVE-2026-107261](https://cve.now/CVE-2026-107261.md): Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201 (CVSS 4.2) - [CVE-2026-107263](https://cve.now/CVE-2026-107263.md): Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202 (CVSS 5.4) - [CVE-2026-107264](https://cve.now/CVE-2026-107264.md): Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203 (CVSS 5.4) - [CVE-2026-107265](https://cve.now/CVE-2026-107265.md): Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204 (CVSS 5.4) - [CVE-2026-107266](https://cve.now/CVE-2026-107266.md): Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205 (CVSS 5.3) - [CVE-2026-96389](https://cve.now/CVE-2026-96389.md): Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206 (CVSS 6.5) - [CVE-2026-107268](https://cve.now/CVE-2026-107268.md): Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207 (CVSS 4.3) - [CVE-2026-107267](https://cve.now/CVE-2026-107267.md): DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208 (CVSS 5.3) - [CVE-2026-107306](https://cve.now/CVE-2026-107306.md): Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209 (CVSS 3.8) - [CVE-2026-107307](https://cve.now/CVE-2026-107307.md): SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210 (CVSS 4.3) - [CVE-2026-107308](https://cve.now/CVE-2026-107308.md): Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211 (CVSS 3.1) - [CVE-2026-107309](https://cve.now/CVE-2026-107309.md): Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212 (CVSS 3.7) - [CVE-2026-107310](https://cve.now/CVE-2026-107310.md): Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213 (CVSS 4.3) - [CVE-2026-107311](https://cve.now/CVE-2026-107311.md): Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214 (CVSS 3.7) - [CVE-2026-107312](https://cve.now/CVE-2026-107312.md): Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215 (CVSS 4.3) - [CVE-2026-107255](https://cve.now/CVE-2026-107255.md): Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216 (CVSS 7.3) - [CVE-2026-107262](https://cve.now/CVE-2026-107262.md): Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217 (CVSS 5.3) - [CVE-2026-108097](https://cve.now/CVE-2026-108097.md): Drupal core - Critical - Remote code execution - SA-CORE-2026-014 (CVSS 8.1) - [CVE-2026-110738](https://cve.now/CVE-2026-110738.md): Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219 (CVSS 6.5) - [CVE-2026-108515](https://cve.now/CVE-2026-108515.md): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015 (CVSS 6.5) - [CVE-2026-108514](https://cve.now/CVE-2026-108514.md): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016 (CVSS 6.5) - [CVE-2026-108099](https://cve.now/CVE-2026-108099.md): Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218 (CVSS 8.1) - [CVE-2026-114523](https://cve.now/CVE-2026-114523.md): Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220 (CVSS 9.8) - [CVE-2026-114527](https://cve.now/CVE-2026-114527.md): UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221 (CVSS 7.1) - [CVE-2026-114528](https://cve.now/CVE-2026-114528.md): Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222 (CVSS 7.1) - [CVE-2026-114526](https://cve.now/CVE-2026-114526.md): Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223 (CVSS 7.1) - [CVE-2026-114525](https://cve.now/CVE-2026-114525.md): ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224 (CVSS 7.1) - [CVE-2026-114524](https://cve.now/CVE-2026-114524.md): Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225 (CVSS 7.2) - [CVE-2026-114529](https://cve.now/CVE-2026-114529.md): CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226 (CVSS 6.5) - [CVE-2026-114530](https://cve.now/CVE-2026-114530.md): Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227 (CVSS 5.3) - [CVE-2026-114531](https://cve.now/CVE-2026-114531.md): Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228 (CVSS 6.5) - [CVE-2026-107260](https://cve.now/CVE-2026-107260.md): Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229 (CVSS 6.5) - [CVE-2026-114532](https://cve.now/CVE-2026-114532.md): UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230 (CVSS 6.5) - [CVE-2026-114533](https://cve.now/CVE-2026-114533.md): Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231 (CVSS 5.3) - [CVE-2026-114534](https://cve.now/CVE-2026-114534.md): Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232 (CVSS 5.9) - [CVE-2026-114535](https://cve.now/CVE-2026-114535.md): Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233 (CVSS 5.3) - [CVE-2026-114536](https://cve.now/CVE-2026-114536.md): USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234 (CVSS 6.5) - [CVE-2026-114537](https://cve.now/CVE-2026-114537.md): View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235 (CVSS 5.3) - [CVE-2026-114538](https://cve.now/CVE-2026-114538.md): Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236 (CVSS 7.1) - [CVE-2026-114539](https://cve.now/CVE-2026-114539.md): DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237 (CVSS 6.3) - [CVE-2026-114540](https://cve.now/CVE-2026-114540.md): Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238 (CVSS 6.3) - [CVE-2026-114543](https://cve.now/CVE-2026-114543.md): Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239 (no CVSS) - [CVE-2026-114541](https://cve.now/CVE-2026-114541.md): Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240 (CVSS 4.8) - [CVE-2026-114553](https://cve.now/CVE-2026-114553.md): Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241 (CVSS 5.4) - [CVE-2026-114542](https://cve.now/CVE-2026-114542.md): Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242 (CVSS 5.4) - [CVE-2026-114544](https://cve.now/CVE-2026-114544.md): Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243 (CVSS 5.4) - [CVE-2026-114545](https://cve.now/CVE-2026-114545.md): Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244 (CVSS 5.4) - [CVE-2026-114546](https://cve.now/CVE-2026-114546.md): Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245 (CVSS 3.7) - [CVE-2026-114547](https://cve.now/CVE-2026-114547.md): TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246 (CVSS 3.7) - [CVE-2026-114548](https://cve.now/CVE-2026-114548.md): ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247 (CVSS 3.7) - [CVE-2026-107256](https://cve.now/CVE-2026-107256.md): Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248 (CVSS 5.3) - [CVE-2026-114572](https://cve.now/CVE-2026-114572.md): Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249 (CVSS 5.4) - [CVE-2026-114555](https://cve.now/CVE-2026-114555.md): Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250 (CVSS 3.5) - [CVE-2026-114554](https://cve.now/CVE-2026-114554.md): AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251 (CVSS 4.3) - [CVE-2026-114571](https://cve.now/CVE-2026-114571.md): Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252 (CVSS 6.5) - [CVE-2026-114573](https://cve.now/CVE-2026-114573.md): Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253 (CVSS 8.8) - [CVE-2026-118539](https://cve.now/CVE-2026-118539.md): Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 (CVSS 6.5) - [CVE-2026-118540](https://cve.now/CVE-2026-118540.md): Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255 (CVSS 5.3) - [CVE-2026-118541](https://cve.now/CVE-2026-118541.md): Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256 (CVSS 4.3) - [CVE-2026-118542](https://cve.now/CVE-2026-118542.md): Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257 (CVSS 2.7) - [CVE-2026-118543](https://cve.now/CVE-2026-118543.md): Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258 (CVSS 5.3) - [CVE-2026-118544](https://cve.now/CVE-2026-118544.md): Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259 (CVSS 3.7) - [CVE-2026-118555](https://cve.now/CVE-2026-118555.md): Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260 (CVSS 6.3) - [CVE-2026-118556](https://cve.now/CVE-2026-118556.md): Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261 (CVSS 6.5) - [CVE-2026-118557](https://cve.now/CVE-2026-118557.md): Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262 (CVSS 2.7) - [CVE-2026-118558](https://cve.now/CVE-2026-118558.md): Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263 (CVSS 7.3) - [CVE-2026-118559](https://cve.now/CVE-2026-118559.md): Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264 (CVSS 5.3) - [CVE-2026-118560](https://cve.now/CVE-2026-118560.md): Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265 (CVSS 5.1) - [CVE-2026-118545](https://cve.now/CVE-2026-118545.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266 (CVSS 6.5) - [CVE-2026-118546](https://cve.now/CVE-2026-118546.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267 (CVSS 6.5) - [CVE-2026-118548](https://cve.now/CVE-2026-118548.md): AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268 (CVSS 3.7) - [CVE-2026-118549](https://cve.now/CVE-2026-118549.md): AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269 (CVSS 7.1) - [CVE-2026-118550](https://cve.now/CVE-2026-118550.md): AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270 (CVSS 5.9) - [CVE-2026-118551](https://cve.now/CVE-2026-118551.md): AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271 (CVSS 3.1) - [CVE-2026-118552](https://cve.now/CVE-2026-118552.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272 (CVSS 6.5) - [CVE-2026-118553](https://cve.now/CVE-2026-118553.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273 (CVSS 5.5) - [CVE-2026-118561](https://cve.now/CVE-2026-118561.md): Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274 (CVSS 7.2) - [CVE-2026-118562](https://cve.now/CVE-2026-118562.md): Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275 (CVSS 7.2) - [CVE-2026-118563](https://cve.now/CVE-2026-118563.md): CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276 (CVSS 6.6) - [CVE-2026-118564](https://cve.now/CVE-2026-118564.md): PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277 (CVSS 6.6) - [CVE-2026-118565](https://cve.now/CVE-2026-118565.md): GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278 (CVSS 7.2) - [CVE-2026-118582](https://cve.now/CVE-2026-118582.md): CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281 (CVSS 7.3) - [CVE-2026-118569](https://cve.now/CVE-2026-118569.md): Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282 (CVSS 5.4) - [CVE-2026-118570](https://cve.now/CVE-2026-118570.md): Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283 (CVSS 6.5) - [CVE-2026-118574](https://cve.now/CVE-2026-118574.md): S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279 (CVSS 5.6) - [CVE-2026-118567](https://cve.now/CVE-2026-118567.md): Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280 (CVSS 4.7) - [CVE-2026-118572](https://cve.now/CVE-2026-118572.md): OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284 (CVSS 4.8) - [CVE-2026-118575](https://cve.now/CVE-2026-118575.md): Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285 (CVSS 6.1) - [CVE-2026-118576](https://cve.now/CVE-2026-118576.md): Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286 (CVSS 6.5) - [CVE-2026-118554](https://cve.now/CVE-2026-118554.md): OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287 (CVSS 5.4) - [CVE-2026-118583](https://cve.now/CVE-2026-118583.md): Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288 (CVSS 5.3) - [CVE-2026-118584](https://cve.now/CVE-2026-118584.md): Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289 (CVSS 5.3) - [CVE-2026-118573](https://cve.now/CVE-2026-118573.md): OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290 (CVSS 4.8) - [CVE-2026-118568](https://cve.now/CVE-2026-118568.md): Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291 (CVSS 3.3) - [CVE-2026-118571](https://cve.now/CVE-2026-118571.md): Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292 (CVSS 5.9) - [CVE-2026-84910](https://cve.now/CVE-2026-84910.md): Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118 (CVSS 4.2) - [CVE-2026-84911](https://cve.now/CVE-2026-84911.md): AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119 (CVSS 3.1) - [CVE-2026-84912](https://cve.now/CVE-2026-84912.md): AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120 (CVSS 4.6) - [CVE-2026-84913](https://cve.now/CVE-2026-84913.md): AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121 (CVSS 4.6) - [CVE-2026-84914](https://cve.now/CVE-2026-84914.md): Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122 (CVSS 5.3) - [CVE-2026-84915](https://cve.now/CVE-2026-84915.md): Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123 (CVSS 4.6) - [CVE-2026-84923](https://cve.now/CVE-2026-84923.md): Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124 (CVSS 6.5) - [CVE-2026-84924](https://cve.now/CVE-2026-84924.md): Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125 (CVSS 5.4) - [CVE-2026-84916](https://cve.now/CVE-2026-84916.md): Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126 (CVSS 3.7) - [CVE-2026-84917](https://cve.now/CVE-2026-84917.md): Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127 (CVSS 6.5) - [CVE-2026-16648](https://cve.now/CVE-2026-16648.md): Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128 (CVSS 3.8) - [CVE-2026-81163](https://cve.now/CVE-2026-81163.md): Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129 (CVSS 5.4) - [CVE-2026-84918](https://cve.now/CVE-2026-84918.md): Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130 (CVSS 3.7) - [CVE-2026-84919](https://cve.now/CVE-2026-84919.md): PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131 (CVSS 4.6) - [CVE-2026-84920](https://cve.now/CVE-2026-84920.md): Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132 (CVSS 5.3) - [CVE-2026-84921](https://cve.now/CVE-2026-84921.md): Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133 (CVSS 5.3) - [CVE-2026-87936](https://cve.now/CVE-2026-87936.md): amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134 (CVSS 6.5) - [CVE-2026-87937](https://cve.now/CVE-2026-87937.md): Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135 (CVSS 6.5) - [CVE-2026-87938](https://cve.now/CVE-2026-87938.md): CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136 (CVSS 6.5) - [CVE-2026-87939](https://cve.now/CVE-2026-87939.md): Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137 (CVSS 4.2) - [CVE-2026-87940](https://cve.now/CVE-2026-87940.md): Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138 (CVSS 5.4) - [CVE-2026-87941](https://cve.now/CVE-2026-87941.md): Patreon - Critical - Unsupported - SA-CONTRIB-2026-139 (CVSS 5.9) - [CVE-2026-87942](https://cve.now/CVE-2026-87942.md): SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140 (CVSS 4.6) - [CVE-2026-87943](https://cve.now/CVE-2026-87943.md): SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141 (CVSS 6.5) - [CVE-2026-87944](https://cve.now/CVE-2026-87944.md): SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142 (CVSS 4.8) - [CVE-2026-87945](https://cve.now/CVE-2026-87945.md): SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143 (CVSS 5.4) - [CVE-2026-87946](https://cve.now/CVE-2026-87946.md): SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144 (CVSS 4.8) - [CVE-2026-87947](https://cve.now/CVE-2026-87947.md): SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145 (CVSS 4.8) - [CVE-2026-87948](https://cve.now/CVE-2026-87948.md): SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146 (CVSS 3.5) - [CVE-2026-87949](https://cve.now/CVE-2026-87949.md): SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147 (CVSS 3.3) - [CVE-2026-87950](https://cve.now/CVE-2026-87950.md): SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148 (CVSS 5.3) - [CVE-2026-87951](https://cve.now/CVE-2026-87951.md): SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149 (CVSS 3.8) - [CVE-2026-87952](https://cve.now/CVE-2026-87952.md): SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150 (CVSS 3.1) - [CVE-2026-87953](https://cve.now/CVE-2026-87953.md): SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151 (CVSS 3.3) - [CVE-2026-87954](https://cve.now/CVE-2026-87954.md): Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152 (CVSS 4.3) - [CVE-2026-87955](https://cve.now/CVE-2026-87955.md): Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153 (CVSS 4.3) - [CVE-2026-96360](https://cve.now/CVE-2026-96360.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154 (CVSS 3.5) - [CVE-2026-96361](https://cve.now/CVE-2026-96361.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155 (CVSS 4.6) - [CVE-2026-96358](https://cve.now/CVE-2026-96358.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158 (CVSS 4.6) - [CVE-2026-96359](https://cve.now/CVE-2026-96359.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159 (CVSS 4.6) - [CVE-2026-96362](https://cve.now/CVE-2026-96362.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160 (CVSS 4.2) - [CVE-2026-96363](https://cve.now/CVE-2026-96363.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161 (CVSS 3.1) - [CVE-2026-96367](https://cve.now/CVE-2026-96367.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162 (CVSS 4.6) - [CVE-2026-96368](https://cve.now/CVE-2026-96368.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163 (CVSS 4.6) - [CVE-2026-96370](https://cve.now/CVE-2026-96370.md): Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164 (CVSS 5.4) - [CVE-2026-96369](https://cve.now/CVE-2026-96369.md): Webform - Less critical - Access bypass - SA-CONTRIB-2026-165 (CVSS 3.1) - [CVE-2026-96371](https://cve.now/CVE-2026-96371.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166 (CVSS 5.4) - [CVE-2026-96372](https://cve.now/CVE-2026-96372.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167 (CVSS 5.4) - [CVE-2026-96373](https://cve.now/CVE-2026-96373.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168 (CVSS 3.3) - [CVE-2026-96366](https://cve.now/CVE-2026-96366.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169 (CVSS 5.3) - [CVE-2026-96365](https://cve.now/CVE-2026-96365.md): Webform - Less critical - Denial of service - SA-CONTRIB-2026-170 (CVSS 7.5) - [CVE-2026-96364](https://cve.now/CVE-2026-96364.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171 (CVSS 5.3) - [CVE-2026-96357](https://cve.now/CVE-2026-96357.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172 (CVSS 4.6) - [CVE-2026-96398](https://cve.now/CVE-2026-96398.md): Webform - Less critical - Access bypass - SA-CONTRIB-2026-173 (CVSS 4.3) - [CVE-2026-96356](https://cve.now/CVE-2026-96356.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174 (CVSS 5.3) - [CVE-2026-96355](https://cve.now/CVE-2026-96355.md): Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175 (CVSS 9.1) - [CVE-2026-96375](https://cve.now/CVE-2026-96375.md): Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176 (CVSS 4.8) - [CVE-2026-96376](https://cve.now/CVE-2026-96376.md): Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177 (CVSS 6.4) - [CVE-2026-96374](https://cve.now/CVE-2026-96374.md): Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178 (CVSS 4.2) - [CVE-2026-96378](https://cve.now/CVE-2026-96378.md): Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179 (CVSS 4.3) - [CVE-2026-96384](https://cve.now/CVE-2026-96384.md): Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180 (CVSS 3.5) - [CVE-2026-96379](https://cve.now/CVE-2026-96379.md): CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181 (CVSS 3.5) - [CVE-2026-96385](https://cve.now/CVE-2026-96385.md): REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182 (CVSS 6.5) - [CVE-2026-96387](https://cve.now/CVE-2026-96387.md): Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183 (CVSS 3.8) - [CVE-2026-96388](https://cve.now/CVE-2026-96388.md): Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184 (CVSS 5.4) - [CVE-2026-96390](https://cve.now/CVE-2026-96390.md): Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185 (CVSS 4.3) - [CVE-2026-96391](https://cve.now/CVE-2026-96391.md): Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186 (CVSS 4.3) - [CVE-2026-96392](https://cve.now/CVE-2026-96392.md): AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187 (CVSS 3.5) - [CVE-2026-96377](https://cve.now/CVE-2026-96377.md): Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188 (CVSS 5.3) - [CVE-2026-96380](https://cve.now/CVE-2026-96380.md): CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189 (CVSS 6.5) - [CVE-2026-96386](https://cve.now/CVE-2026-96386.md): Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190 (CVSS 6.5) - [CVE-2026-96382](https://cve.now/CVE-2026-96382.md): Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191 (CVSS 4.6) - [CVE-2026-16647](https://cve.now/CVE-2026-16647.md): Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111 (CVSS 4.1) - [CVE-2026-18986](https://cve.now/CVE-2026-18986.md): Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094 (CVSS 4.8) - [CVE-2026-73475](https://cve.now/CVE-2026-73475.md): Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095 (CVSS 9.1) - [CVE-2026-73478](https://cve.now/CVE-2026-73478.md): Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096 (CVSS 5.3) - [CVE-2026-73474](https://cve.now/CVE-2026-73474.md): Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097 (CVSS 5.3) - [CVE-2026-73476](https://cve.now/CVE-2026-73476.md): External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098 (CVSS 5.4) - [CVE-2026-73477](https://cve.now/CVE-2026-73477.md): Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099 (CVSS 5.3) - [CVE-2026-76757](https://cve.now/CVE-2026-76757.md): Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 (CVSS 5.9) - [CVE-2026-76756](https://cve.now/CVE-2026-76756.md): Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 (CVSS 5.9) - [CVE-2026-76755](https://cve.now/CVE-2026-76755.md): Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 (CVSS 5.9) - [CVE-2026-76758](https://cve.now/CVE-2026-76758.md): Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101 (CVSS 5.9) - [CVE-2026-76782](https://cve.now/CVE-2026-76782.md): Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 (CVSS 7.3) - [CVE-2026-76759](https://cve.now/CVE-2026-76759.md): Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 (CVSS 7.3) - [CVE-2026-81167](https://cve.now/CVE-2026-81167.md): Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103 (CVSS 4.8) - [CVE-2026-81165](https://cve.now/CVE-2026-81165.md): Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104 (CVSS 5.3) - [CVE-2026-81168](https://cve.now/CVE-2026-81168.md): CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105 (CVSS 3.7) - [CVE-2026-81159](https://cve.now/CVE-2026-81159.md): Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106 (CVSS 3.7) - [CVE-2026-81161](https://cve.now/CVE-2026-81161.md): Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107 (CVSS 3.3) - [CVE-2026-81269](https://cve.now/CVE-2026-81269.md): Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108 (CVSS 5.3) - [CVE-2026-81166](https://cve.now/CVE-2026-81166.md): Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109 (CVSS 5.3) - [CVE-2026-81162](https://cve.now/CVE-2026-81162.md): DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112 (CVSS 5.3) - [CVE-2026-81158](https://cve.now/CVE-2026-81158.md): Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113 (CVSS 5.3) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/drupal Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.