Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-118564PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277
- CVE-2026-118565GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278
- CVE-2026-118582CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281
- CVE-2026-118569Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282
- CVE-2026-118570Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283
- CVE-2026-118574S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279
- CVE-2026-118567Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280
- CVE-2026-118572OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284
- CVE-2026-118575Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285
- CVE-2026-118576Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286
- CVE-2026-118554OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287
- CVE-2026-118583Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288
- CVE-2026-118584Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289
- CVE-2026-118573OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290
- CVE-2026-118568Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291
- CVE-2026-118571Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292
- CVE-2026-84910Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118
- CVE-2026-84911AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119
- CVE-2026-84912AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120
- CVE-2026-84913AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121
- CVE-2026-84914Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122
- CVE-2026-84915Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123
- CVE-2026-84923Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124
- CVE-2026-84924Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125
- CVE-2026-84916Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126
- CVE-2026-84917Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127
- CVE-2026-16648Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128
- CVE-2026-81163Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129
- CVE-2026-84918Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130
- CVE-2026-84919PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131