Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-108515Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
- CVE-2026-108514Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
- CVE-2026-108099Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218
- CVE-2026-114523Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220
- CVE-2026-114527UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221
- CVE-2026-114528Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222
- CVE-2026-114526Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223
- CVE-2026-114525ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224
- CVE-2026-114524Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225
- CVE-2026-114529CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226
- CVE-2026-114530Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227
- CVE-2026-114531Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228
- CVE-2026-107260Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229
- CVE-2026-114532UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230
- CVE-2026-114533Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231
- CVE-2026-114534Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232
- CVE-2026-114535Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233
- CVE-2026-114536USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234
- CVE-2026-114537View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235
- CVE-2026-114538Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236
- CVE-2026-114539DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237
- CVE-2026-114540Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238
- CVE-2026-114543Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239
- CVE-2026-114541Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240
- CVE-2026-114553Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241
- CVE-2026-114542Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242
- CVE-2026-114544Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243
- CVE-2026-114545Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244
- CVE-2026-114546Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245
- CVE-2026-114547TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246