Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-58590FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068
- CVE-2026-58589FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067
- CVE-2026-58588Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066
- CVE-2026-58587Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065
- CVE-2026-13244Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064
- CVE-2026-13243Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063
- CVE-2026-13242Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062
- CVE-2026-13241Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061
- CVE-2026-13240Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060
- CVE-2026-13239WissKI - Critical - Access bypass - SA-CONTRIB-2026-059
- CVE-2026-13238Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058
- CVE-2026-13237AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057
- CVE-2026-13236AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056
- CVE-2026-13235AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055
- CVE-2026-13234AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054
- CVE-2026-13233OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053
- CVE-2026-13232Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052
- CVE-2026-13231Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051
- CVE-2026-55810Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050
- CVE-2026-55809Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049
- CVE-2026-12535Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048
- CVE-2026-11909Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044
- CVE-2026-11908Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043
- CVE-2026-10770Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042
- CVE-2026-10769Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041
- CVE-2026-10768LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039
- CVE-2026-9726Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038
- CVE-2026-6816TFA Basic Plugins - Access Bypass
- CVE-2026-5343SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031
- CVE-2026-4093Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels)