CVE Program partner

drupal

Drupal.org

API
CVEs, 365 days166407 all time, 0 rejected
Quality65%median 99%
CVSS by the CNA6%share of records
CWE89%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA93%lower is better
OrganisationDrupal.org
RoleCNA
TypeVendor, Open Source
Reports tomitre
ScopeAll projects hosted under <a href='https://www.drupal.org' target='_blank'>drupal.org</a>, including End of Life (EOL) code.
Advisorieshttps://www.drupal.org/security

Latest CVEs · RSS

  • CVE-2026-16647 2026-09-02
    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Logi
  • CVE-2026-18986 2026-09-02
    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affect
  • CVE-2026-73475 2026-09-02
    Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, fro
  • CVE-2026-73478 2026-09-02
    Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
  • CVE-2026-73474 2026-09-02
    Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versio
  • CVE-2026-73476 2026-09-02
    Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication ve
  • CVE-2026-73477 2026-09-02
    Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.
  • CVE-2026-76757 2026-09-02
    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.
  • CVE-2026-76756 2026-09-02
    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.
  • CVE-2026-76755 2026-09-02
    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.
  • CVE-2026-76758 2026-09-02
    Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*.
  • CVE-2026-76782 2026-09-02
    Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.
  • CVE-2026-76759 2026-09-02
    Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.
  • CVE-2026-81167 2026-09-02
    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS
  • CVE-2026-81165 2026-09-02
    Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.
  • CVE-2026-81168 2026-09-02
    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA
  • CVE-2026-81159 2026-09-02
    Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1
  • CVE-2026-81161 2026-09-02
    Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderatio
  • CVE-2026-81269 2026-09-02
    Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.
  • CVE-2026-81166 2026-09-02
    Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.
  • CVE-2026-81162 2026-09-02
    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. Th
  • CVE-2026-81158 2026-09-02
    Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.
  • CVE-2026-81164 2026-09-02
    Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.
  • CVE-2026-81205 2026-09-02
    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Inj
  • CVE-2026-81201 2026-09-02
    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects

All CVE Program partners