Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how drupal compares to other vendors in security performance

View Risk Score →

Software

drupal drupal
466
drupal
396
drupal drupal core
24
drupal webform
20
drupal saml sso - service provider
13
drupal views
9
drupal project issue tracking module
6
drupal enterprise mfa - tfa
5
drupal monster menus
5
drupal print
5
drupal aggregation module
4
drupal ai
4
drupal core
4
drupal everyblog
4
drupal paragraphs
4
drupal project
4
drupal ai (artificial intelligence)
3
drupal authenticator login
3
drupal canvas project drupal canvas drupal
3
drupal content construction kit
3
drupal drupal canvas
3
drupal drupal project issue tracking
3
drupal one time password
3
drupal shindig integrator
3
drupal two-factor authentication
3
drupal ai agents
2
drupal ajax checklist
2
drupal bibliography module
2
drupal central authentication system (cas) server
2
drupal chatroom module
2
drupal civictheme design system
2
drupal cloud
2
drupal cookies consent management
2
drupal custom search module
2
drupal data
2
drupal database administration module
2
drupal drupal easylinks module
2
drupal email tfa
2
drupal facets
2
drupal file entity
2
drupal flowdrop
2
drupal google tag
2
drupal help tip module
2
drupal imce module
2
drupal localization client
2
drupal logintoboggan module
2
drupal migrate
2
drupal node access rebuild progressive
2
drupal open social
2
drupal opigno group manager
2

Drupal Advanced SearchAdvanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118

Risk 28
Severity
4.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.

First published (updated )
CVE-2026-84910

Drupal AI (Artificial Intelligence)AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119

Risk 22
Severity
3.1
XSS
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

First published (updated )
CVE-2026-84911

Drupal AI TranslateAI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121

Risk 30
Severity
4.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.

First published (updated )
CVE-2026-84913

Drupal AI (Artificial Intelligence)AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120

Risk 30
Severity
4.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

First published (updated )
CVE-2026-84912

Drupal Calculate Working DaysCalculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122

Risk 27
Severity
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.

First published (updated )
CVE-2026-84914

Drupal Component blocksComponent blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123

Risk 30
Severity
4.6
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.

First published (updated )
CVE-2026-84915

Drupal Email Verification / SMS Verification / OTP VerificationEmail Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124

Risk 40
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

First published (updated )
CVE-2026-84923

Drupal Email VerificationEmail Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125

Risk 34
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

First published (updated )
CVE-2026-84924

Drupal Jsonapi Role AccessJsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

Risk 40
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.

First published (updated )
CVE-2026-84917

Drupal Mailer Plus LogMailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128

Risk 26
Severity
3.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.

First published (updated )
CVE-2026-16648

Drupal Media Library ImporterMedia Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129

Risk 34
Severity
5.4
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.

First published (updated )
CVE-2026-81163

Drupal Monobank payment APIMonobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130

Risk 20
Severity
3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.

First published (updated )
CVE-2026-84918

Drupal PhotoSwipe - Responsive JavaScript Modal Image GalleryPhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131

Risk 30
Severity
4.6
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.

First published (updated )
CVE-2026-84919

Drupal Webform Submissions DeleteWebform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

Risk 27
Severity
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.

First published (updated )
CVE-2026-84921

Drupal Unpublished Node PermissionsUnpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132

Risk 27
Severity
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.

First published (updated )
CVE-2026-84920

Drupal Central Authentication System (CAS) ServerCentral Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

Risk 40
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

First published (updated )
CVE-2026-87937

Drupal CSP logCSP log - Critical - SQL Injection - SA-CONTRIB-2026-136

Risk 49
Severity
6.5
SQL Injection
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.

First published (updated )
CVE-2026-87938

Drupal Feed BlockFeed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137

Risk 29
Severity
4.2
XSS
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.

First published (updated )
CVE-2026-87939

Drupal Key authKey auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

Risk 34
Severity
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.

First published (updated )
CVE-2026-87940

Drupal PatreonPatreon - Critical - Unsupported - SA-CONTRIB-2026-139

Risk 45
Severity
5.9
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.

First published (updated )
CVE-2026-87941

Drupal SafeDeleteSafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140

Risk 30
Severity
4.6
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.

First published (updated )
CVE-2026-87942

Drupal SAML SSO - Service ProviderSAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

Risk 40
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

First published (updated )
CVE-2026-87943

Drupal SAML SSO - Service ProviderSAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142

Risk 32
Severity
4.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

First published (updated )
CVE-2026-87944

Drupal SAML SSO - Service ProviderSAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144

Risk 32
Severity
4.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

First published (updated )
CVE-2026-87946

Drupal SAML SSO - Service ProviderSAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143

Risk 34
Severity
5.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

First published (updated )
CVE-2026-87945

Drupal SAML SSO - Service ProviderSAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145

Risk 32
Severity
4.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

First published (updated )
CVE-2026-87947

Drupal SAML SSO - Service ProviderSAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146

Risk 24
Severity
3.5
XSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

First published (updated )
CVE-2026-87948

Drupal SAML SSO - Service ProviderSAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147

Risk 23
Severity
3.3
XSS
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

First published (updated )
CVE-2026-87949

Drupal SAML SSO - Service ProviderSAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148

Risk 27
Severity
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

First published (updated )
CVE-2026-87950

Drupal SAML SSO - Service ProviderSAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149

Risk 26
Severity
3.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

First published (updated )
CVE-2026-87951

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203