Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-114548ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247
- CVE-2026-107256Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248
- CVE-2026-114572Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249
- CVE-2026-114555Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250
- CVE-2026-114554AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251
- CVE-2026-114571Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252
- CVE-2026-114573Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253
- CVE-2026-118539Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
- CVE-2026-118540Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255
- CVE-2026-118541Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256
- CVE-2026-118542Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257
- CVE-2026-118543Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258
- CVE-2026-118544Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259
- CVE-2026-118555Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260
- CVE-2026-118556Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261
- CVE-2026-118557Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262
- CVE-2026-118558Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263
- CVE-2026-118559Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264
- CVE-2026-118560Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265
- CVE-2026-118545AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266
- CVE-2026-118546AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267
- CVE-2026-118548AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268
- CVE-2026-118549AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269
- CVE-2026-118550AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270
- CVE-2026-118551AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271
- CVE-2026-118552AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272
- CVE-2026-118553AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273
- CVE-2026-118561Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274
- CVE-2026-118562Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275
- CVE-2026-118563CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276