Vendor CVEs

Drupal

All CVEs

1,430 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-1917	Drupal Login Disable	Med	0.28	4.3	0.00	Mar 25, 2026	Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Login Disable allows Functionality Bypass.This issue affects Login Disable: from 0.0.0 before 2.1.3.
CVE-2025-13082	Drupal Drupal	Med	0.28	4.3	0.00	Nov 18, 2025	User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
CVE-2025-8996	Drupal Layout Builder Advanced Permissions	Med	0.28	4.3	0.00	Aug 15, 2025	Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.This issue affects Layout Builder Advanced Permissions: from 0.0.0 before 2.2.0.
CVE-2025-5682	Drupal Klaro Cookie & Consent Management	Med	0.28	4.3	0.00	Jun 26, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.7.
CVE-2025-3907	Drupal Search API Solr	Med	0.28	4.3	0.00	Apr 23, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 before 4.3.9.
CVE-2025-31675	Drupal Drupal	Med	0.28	5.4	0.00	Mar 31, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from…
CVE-2024-13288	Drupal Monster Menus	Med	0.28	4.3	0.00	Jan 9, 2025	Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.
CVE-2024-13271	Drupal Content Entity Clone	Med	0.28	4.3	0.00	Jan 9, 2025	Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4.
CVE-2024-13270	Drupal Freelinking	Med	0.28	4.3	0.00	Jan 9, 2025	Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1.
CVE-2024-12393	Drupal Drupal	Med	0.28	5.4	0.00	Dec 10, 2024	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
CVE-2022-24728	Fckeditor Ckeditor4	Med	0.28	5.4	0.01	Mar 16, 2022	CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing…
CVE-2013-4228	Organic Groups Project Organic Groups	Med	0.28	4.3	0.01	Feb 18, 2020	The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary…
CVE-2012-5570	Drupal Basic webmail module	Med	0.28	4.3	0.01	Feb 8, 2020	The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users' email addresses.
CVE-2019-10909	Sensiolabs Symfony	Med	0.28	5.4	0.01	May 16, 2019	In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
CVE-2015-7880	Drupal Drupal	Med	0.28	4.3	0.02	Sep 13, 2017	The Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to obtain sensitive event registration information by leveraging the "Register other accounts" permission and knowledge of usernames.
CVE-2016-9449	Drupal Drupal	Med	0.28	4.3	0.02	Nov 25, 2016	The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
CVE-2016-7572	Drupal Drupal	Med	0.28	4.3	0.02	Oct 3, 2016	The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.
CVE-2016-7570	Drupal Drupal	Med	0.28	4.3	0.02	Oct 3, 2016	Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.
CVE-2026-81269	Drupal Data field	Med	0.27	5.3	0.00	Sep 2, 2026	Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.
CVE-2026-81205	Drupal LDAP / Active Directory Integration	Med	0.27	5.3	0.00	Sep 2, 2026	Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.
CVE-2026-81166	Drupal Digital Signage Framework	Med	0.27	5.3	0.00	Sep 2, 2026	Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1.
CVE-2026-81165	Drupal Blazy	Med	0.27	5.3	0.00	Sep 2, 2026	Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.
CVE-2026-81162	Drupal DXPR Builder	Med	0.27	5.3	0.00	Sep 2, 2026	Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1.
CVE-2026-73478	Drupal Diff	Med	0.27	5.3	0.00	Sep 2, 2026	Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
CVE-2026-73477	Drupal Quick Tabs	Med	0.27	5.3	0.00	Sep 2, 2026	Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.
CVE-2026-73474	Drupal Entity Share Websub	Med	0.27	5.3	0.00	Sep 2, 2026	Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.
CVE-2026-3532	Drupal OpenID Connect / OAuth client	Med	0.27	4.2	0.00	Mar 26, 2026	Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.
CVE-2026-1554	Drupal Central Authentication System (CAS) Server	Med	0.27	4.2	0.00	Feb 4, 2026	XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.
CVE-2025-13986	Drupal Disable Login Page	Med	0.27	4.2	0.00	Jan 28, 2026	Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.
CVE-2024-13274	Drupal Open Social	Med	0.27	5.3	0.00	Jan 9, 2025	Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.
CVE-2026-6816	Drupal TFA Basic Plugins	Low	0.25	3.8	0.00	May 28, 2026	An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.
CVE-2025-10931	Umami Umami Analytics	Low	0.25	3.8	0.00	Oct 30, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS).This issue affects Umami Analytics: from 0.0.0 before 1.0.1.
CVE-2024-13308	Drupal Browser Back Button	Low	0.25	3.8	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.
CVE-2026-81167	Drupal Address Suggestion	Med	0.24	4.8	0.00	Sep 2, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.
CVE-2026-81159	Drupal Commerce CyberSource	Low	0.24	3.7	0.00	Sep 2, 2026	Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.
CVE-2026-15917	Drupal Drupal Core	Med	0.24	4.7	0.00	Aug 25, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.
CVE-2026-13237	Drupal AI Agents	Med	0.24	4.8	0.00	Jul 10, 2026	Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.
CVE-2026-8491	Drupal Node View Permissions	Low	0.24	3.7	0.00	May 19, 2026	Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Permissions: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.1.
CVE-2025-13083	Drupal Drupal	Low	0.24	3.7	0.00	Nov 18, 2025	Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9,…
CVE-2025-12761	Drupal Simple multi step form	Low	0.23	3.5	0.00	Nov 18, 2025	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).This issue affects Simple multi step form: from 0.0.0 before 2.0.0.
CVE-2024-13261	Drupal Acquia DAM	Low	0.23	3.5	0.00	Jan 9, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3.
CVE-2026-81161	Drupal Content Moderation Notifications	Low	0.21	3.3	0.00	Sep 2, 2026	Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.
CVE-2026-15080	Drupal Drupal	Med	0.21	4.3	0.00	Jul 10, 2026	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4.
CVE-2026-16647	Drupal Disable Login Page	Med	0.20	4.1	0.00	Sep 2, 2026	Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
CVE-2026-15916	Drupal Drupal Core	Med	0.20	4.2	0.00	Aug 25, 2026	Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from 0.0.0 to 11.2.*.
CVE-2026-55807	Drupal Drupal	Low	0.20	3.1	0.00	Jul 10, 2026	Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to…
CVE-2026-15083	Drupal Drupal	Med	0.20	4.2	0.00	Jul 10, 2026	Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to…
CVE-2026-13236	Drupal AI Agents	Med	0.20	4.2	0.00	Jul 10, 2026	Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.
CVE-2026-13232	Drupal Advanced Content Feedback	Low	0.20	3.1	0.00	Jul 10, 2026	Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.
CVE-2025-48009	Drupal Single Content Sync	Low	0.20	3.1	0.00	May 21, 2025	Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12.

CVE-2026-1917MedMar 25, 2026
Drupal
Login Disable
risk 0.28cvss 4.3epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Login Disable allows Functionality Bypass.This issue affects Login Disable: from 0.0.0 before 2.1.3.
CVE-2025-13082MedNov 18, 2025
Drupal
Drupal
risk 0.28cvss 4.3epss 0.00
User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
CVE-2025-8996MedAug 15, 2025
Drupal
Layout Builder Advanced Permissions
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.This issue affects Layout Builder Advanced Permissions: from 0.0.0 before 2.2.0.
CVE-2025-5682MedJun 26, 2025
Drupal
Klaro Cookie & Consent Management
risk 0.28cvss 4.3epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.7.
CVE-2025-3907MedApr 23, 2025
Drupal
Search API Solr
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 before 4.3.9.
CVE-2025-31675MedMar 31, 2025
Drupal
Drupal
risk 0.28cvss 5.4epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from…
CVE-2024-13288MedJan 9, 2025
Drupal
Monster Menus
risk 0.28cvss 4.3epss 0.00
Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.
CVE-2024-13271MedJan 9, 2025
Drupal
Content Entity Clone
risk 0.28cvss 4.3epss 0.00
Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4.
CVE-2024-13270MedJan 9, 2025
Drupal
Freelinking
risk 0.28cvss 4.3epss 0.00
Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1.
CVE-2024-12393MedDec 10, 2024
Drupal
Drupal
risk 0.28cvss 5.4epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
CVE-2022-24728MedMar 16, 2022
Fckeditor
Ckeditor4
risk 0.28cvss 5.4epss 0.01
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing…
CVE-2013-4228MedFeb 18, 2020
Organic Groups Project
Organic Groups
risk 0.28cvss 4.3epss 0.01
The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary…
CVE-2012-5570MedFeb 8, 2020
Drupal
Basic webmail module
risk 0.28cvss 4.3epss 0.01
The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users' email addresses.
CVE-2019-10909MedMay 16, 2019
Sensiolabs
Symfony
risk 0.28cvss 5.4epss 0.01
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
CVE-2015-7880MedSep 13, 2017
Drupal
Drupal
risk 0.28cvss 4.3epss 0.02
The Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to obtain sensitive event registration information by leveraging the "Register other accounts" permission and knowledge of usernames.
CVE-2016-9449MedNov 25, 2016
Drupal
Drupal
risk 0.28cvss 4.3epss 0.02
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
CVE-2016-7572MedOct 3, 2016
Drupal
Drupal
risk 0.28cvss 4.3epss 0.02
The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.
CVE-2016-7570MedOct 3, 2016
Drupal
Drupal
risk 0.28cvss 4.3epss 0.02
Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.
CVE-2026-81269MedSep 2, 2026
Drupal
Data field
risk 0.27cvss 5.3epss 0.00
Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.
CVE-2026-81205MedSep 2, 2026
Drupal
LDAP / Active Directory Integration
risk 0.27cvss 5.3epss 0.00
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.
CVE-2026-81166MedSep 2, 2026
Drupal
Digital Signage Framework
risk 0.27cvss 5.3epss 0.00
Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1.
CVE-2026-81165MedSep 2, 2026
Drupal
Blazy
risk 0.27cvss 5.3epss 0.00
Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.
CVE-2026-81162MedSep 2, 2026
Drupal
DXPR Builder
risk 0.27cvss 5.3epss 0.00
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1.
CVE-2026-73478MedSep 2, 2026
Drupal
Diff
risk 0.27cvss 5.3epss 0.00
Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
CVE-2026-73477MedSep 2, 2026
Drupal
Quick Tabs
risk 0.27cvss 5.3epss 0.00
Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.
CVE-2026-73474MedSep 2, 2026
Drupal
Entity Share Websub
risk 0.27cvss 5.3epss 0.00
Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.
CVE-2026-3532MedMar 26, 2026
Drupal
OpenID Connect / OAuth client
risk 0.27cvss 4.2epss 0.00
Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.
CVE-2026-1554MedFeb 4, 2026
Drupal
Central Authentication System (CAS) Server
risk 0.27cvss 4.2epss 0.00
XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.
CVE-2025-13986MedJan 28, 2026
Drupal
Disable Login Page
risk 0.27cvss 4.2epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.
CVE-2024-13274MedJan 9, 2025
Drupal
Open Social
risk 0.27cvss 5.3epss 0.00
Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.
CVE-2026-6816LowMay 28, 2026
Drupal
TFA Basic Plugins
risk 0.25cvss 3.8epss 0.00
An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.
CVE-2025-10931LowOct 30, 2025
Umami
Umami Analytics
risk 0.25cvss 3.8epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS).This issue affects Umami Analytics: from 0.0.0 before 1.0.1.
CVE-2024-13308LowJan 9, 2025
Drupal
Browser Back Button
risk 0.25cvss 3.8epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.
CVE-2026-81167MedSep 2, 2026
Drupal
Address Suggestion
risk 0.24cvss 4.8epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.
CVE-2026-81159LowSep 2, 2026
Drupal
Commerce CyberSource
risk 0.24cvss 3.7epss 0.00
Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.
CVE-2026-15917MedAug 25, 2026
Drupal
Drupal Core
risk 0.24cvss 4.7epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.
CVE-2026-13237MedJul 10, 2026
Drupal
AI Agents
risk 0.24cvss 4.8epss 0.00
Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.
CVE-2026-8491LowMay 19, 2026
Drupal
Node View Permissions
risk 0.24cvss 3.7epss 0.00
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Permissions: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.1.
CVE-2025-13083LowNov 18, 2025
Drupal
Drupal
risk 0.24cvss 3.7epss 0.00
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9,…
CVE-2025-12761LowNov 18, 2025
Drupal
Simple multi step form
risk 0.23cvss 3.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).This issue affects Simple multi step form: from 0.0.0 before 2.0.0.
CVE-2024-13261LowJan 9, 2025
Drupal
Acquia DAM
risk 0.23cvss 3.5epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3.
CVE-2026-81161LowSep 2, 2026
Drupal
Content Moderation Notifications
risk 0.21cvss 3.3epss 0.00
Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.
CVE-2026-15080MedJul 10, 2026
Drupal
Drupal
risk 0.21cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4.
CVE-2026-16647MedSep 2, 2026
Drupal
Disable Login Page
risk 0.20cvss 4.1epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
CVE-2026-15916MedAug 25, 2026
Drupal
Drupal Core
risk 0.20cvss 4.2epss 0.00
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
CVE-2026-55807LowJul 10, 2026
Drupal
Drupal
risk 0.20cvss 3.1epss 0.00
Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to…
CVE-2026-15083MedJul 10, 2026
Drupal
Drupal
risk 0.20cvss 4.2epss 0.00
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to…
CVE-2026-13236MedJul 10, 2026
Drupal
AI Agents
risk 0.20cvss 4.2epss 0.00
Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.
CVE-2026-13232LowJul 10, 2026
Drupal
Advanced Content Feedback
risk 0.20cvss 3.1epss 0.00
Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.
CVE-2025-48009LowMay 21, 2025
Drupal
Single Content Sync
risk 0.20cvss 3.1epss 0.00
Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12.

Page 10 of 29