Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-3212Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013
- CVE-2026-3211Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012
- CVE-2026-3210Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011
- CVE-2026-2349UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010
- CVE-2026-2348Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009
- CVE-2026-1917Login Disable - Less critical - Access bypass - SA-CONTRIB-2026-008
- CVE-2026-1554Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007
- CVE-2026-1553Drupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-006
- CVE-2026-0948Microsoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-005
- CVE-2026-0947AT Internet Piano Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-004
- CVE-2026-0946AT Internet SmartTag - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-003
- CVE-2026-0945Role Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-002
- CVE-2026-0944Group invite - Moderately critical - Access bypass - SA-CONTRIB-2026-001
- CVE-2025-14840HTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-126
- CVE-2025-14472Acquia Content Hub - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-125
- CVE-2025-13986Disable Login Page - Critical - Access bypass - SA-CONTRIB-2025-124
- CVE-2025-13985Entity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123
- CVE-2025-13984Next.js - Critical - Access bypass - SA-CONTRIB-2025-122
- CVE-2025-13983Tagify - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-121
- CVE-2025-13982Login Time Restriction - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-120
- CVE-2025-13981AI (Artificial Intelligence) - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-119
- CVE-2025-13980CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118
- CVE-2025-13979Mini site - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-117
- CVE-2026-0749Cross-Site Scripting Vulnerability in Drupal Form Builder Module
- CVE-2026-0750Payment bypass in Commerce Paybox
- CVE-2025-14557XSS in Drupal 7 Facebook Pixel Module
- CVE-2025-14556XSS in Drupal 7 Flag Module
- CVE-2025-12848XSS vulnerability when rendering filename in Webform Multiform
- CVE-2025-12761Simple multi step form - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-116
- CVE-2025-12760Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-115