Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-4929Simple Hierarchical Select (Drupal 7) XSS in term-derived output
- CVE-2026-9082Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
- CVE-2026-8495Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037
- CVE-2026-8493Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036
- CVE-2026-8492Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035
- CVE-2026-8491Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034
- CVE-2026-6871Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033
- CVE-2026-6367Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
- CVE-2026-6366Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
- CVE-2026-6365Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
- CVE-2026-6095Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032
- CVE-2026-0748Access bypass in Drupal 7 i18n_node translation UI
- CVE-2026-1556Information disclosure via file URI overwrite in File (Field) Paths
- CVE-2026-4393Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030
- CVE-2026-4933Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029
- CVE-2026-3573AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028
- CVE-2026-3532OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027
- CVE-2026-3531OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026
- CVE-2026-3530OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025
- CVE-2026-3529Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024
- CVE-2026-3528Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023
- CVE-2026-3527AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022
- CVE-2026-3526File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021
- CVE-2026-3525File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020
- CVE-2026-3218Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019
- CVE-2026-3217SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018
- CVE-2026-3216Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017
- CVE-2026-3215Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016
- CVE-2026-3214CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015
- CVE-2026-3213Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014