Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-73475Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
- CVE-2026-73478Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096
- CVE-2026-73474Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
- CVE-2026-73476External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
- CVE-2026-73477Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
- CVE-2026-76757Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100
- CVE-2026-76756Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100
- CVE-2026-76755Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100
- CVE-2026-76758Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101
- CVE-2026-76782Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102
- CVE-2026-76759Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102
- CVE-2026-81167Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103
- CVE-2026-81165Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104
- CVE-2026-81168CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105
- CVE-2026-81159Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106
- CVE-2026-81161Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107
- CVE-2026-81269Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108
- CVE-2026-81166Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109
- CVE-2026-81162DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112
- CVE-2026-81158Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113
- CVE-2026-81164Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114
- CVE-2026-81205LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115
- CVE-2026-81201Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116
- CVE-2026-81160Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117
- CVE-2026-15916Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
- CVE-2026-15917Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011
- CVE-2026-55805Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
- CVE-2026-16638Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
- CVE-2026-16639Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
- CVE-2026-16640Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082