Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-16646PanKM - Critical - Unsupported - SA-CONTRIB-2026-083
- CVE-2026-16641Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084
- CVE-2026-16642Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085
- CVE-2026-16643Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086
- CVE-2026-16644Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
- CVE-2026-16645PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088
- CVE-2026-15088Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089
- CVE-2026-18259Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090
- CVE-2026-18260Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110
- CVE-2026-18261Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092
- CVE-2026-18985Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093
- CVE-2026-11913Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045
- CVE-2026-11914Composer - Critical - Unsupported - SA-CONTRIB-2026-046
- CVE-2026-11915Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047
- CVE-2026-15087Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078
- CVE-2026-15086Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077
- CVE-2026-15089Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079
- CVE-2026-55808Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009
- CVE-2026-55807Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008
- CVE-2026-55806Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007
- CVE-2026-55804Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006
- CVE-2026-55803Drupal core - Critical - PHP object injection - SA-CORE-2026-005
- CVE-2026-15085AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076
- CVE-2026-15084UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075
- CVE-2026-15083ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074
- CVE-2026-15082Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073
- CVE-2026-15081Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072
- CVE-2026-15080Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071
- CVE-2026-15079Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070
- CVE-2026-58591Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069