Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-96370Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164
- CVE-2026-96369Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
- CVE-2026-96371Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166
- CVE-2026-96372Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
- CVE-2026-96373Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168
- CVE-2026-96366Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
- CVE-2026-96365Webform - Less critical - Denial of service - SA-CONTRIB-2026-170
- CVE-2026-96364Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171
- CVE-2026-96357Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172
- CVE-2026-96398Webform - Less critical - Access bypass - SA-CONTRIB-2026-173
- CVE-2026-96356Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174
- CVE-2026-96355Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
- CVE-2026-96375Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176
- CVE-2026-96376Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177
- CVE-2026-96374Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178
- CVE-2026-96378Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179
- CVE-2026-96384Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180
- CVE-2026-96379CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181
- CVE-2026-96385REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182
- CVE-2026-96387Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183
- CVE-2026-96388Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184
- CVE-2026-96390Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185
- CVE-2026-96391Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186
- CVE-2026-96392AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187
- CVE-2026-96377Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188
- CVE-2026-96380CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189
- CVE-2026-96386Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190
- CVE-2026-96382Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191
- CVE-2026-16647Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
- CVE-2026-18986Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094