DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
545
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 39High 72Medium 256Low 30
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-76757 | 5.9 | Sep 2 | Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 Affected: *.* |
| CVE-2026-76756 | 5.9 | Sep 2 | Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 Affected: *.* |
| CVE-2026-76755 | 5.9 | Sep 2 | Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 Affected: *.* |
| CVE-2026-76758 | 5.9 | Sep 2 | Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101 Affected: *.* |
| CVE-2026-11914 | 5.9 | Jul 10 | Composer - Critical - Unsupported - SA-CONTRIB-2026-046 Affected: *.* |
| CVE-2026-11915 | 5.9 | Jul 10 | Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047 Affected: *.* |
| CVE-2026-15087 | 5.9 | Jul 10 | Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078 Affected: *.* |
| CVE-2026-15086 | 5.9 | Jul 10 | Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077 Affected: *.* |
| CVE-2026-55806 | 5.9 | Jul 10 | Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007 Affected: 0.0.0 before 10.5.12; 10.6.0 before 10.6.11; 11.2.0 before 11.2.14; 11.3.0 before 11.3.12; 0.0.0 before 11.0.*; 0.0.0 before 11.1.* |
| CVE-2026-55804 | 5.9 | Jul 10 | Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006 Affected: 0.0.0 before 10.5.12; 10.6.0 before 10.6.11; 11.2.0 before 11.2.14; 11.3.0 before 11.3.12; 0.0.0 before 11.0.*; 0.0.0 before 11.1.* |
| CVE-2026-55803 | 5.9 | Jul 10 | Drupal core - Critical - PHP object injection - SA-CORE-2026-005 Affected: 0.0.0 before 10.5.12; 10.6.0 before 10.6.11; 11.2.0 before 11.2.14; 11.3.0 before 11.3.12; 0.0.0 before 11.0.*; 0.0.0 before 11.1.* |
| CVE-2025-13081 | 5.9 | Nov 18 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from… Affected: 8.0.0 before 10.4.9; 10.5.0 before 10.5.6; 11.0.0 before 11.1.9; 11.2.0 before 11.2.8 |
| CVE-2024-11942 | 5.9 | Dec 5 | A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10 Affected: 10.0.0 before 10.2.10 |
| CVE-2017-6921 | 5.9 | Jan 15 | File REST resource does not properly validate Affected: Drupal 8 before 8.3.4 |
| CVE-2016-3166 | 5.9 | Apr 12 | CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2026-16646 | 5.7 | Aug 25 | PanKM - Critical - Unsupported - SA-CONTRIB-2026-083 Affected: *.* |
| CVE-2026-16642 | 5.7 | Aug 25 | Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085 Affected: *.* |
| CVE-2026-16643 | 5.7 | Aug 25 | Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086 Affected: *.* |
| CVE-2026-15088 | 5.7 | Aug 25 | Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089 Affected: *.* |
| CVE-2026-18260 | 5.7 | Aug 25 | Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110 Affected: 0.0.0 before 1.1.4 |
| CVE-2026-18261 | 5.7 | Aug 25 | Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092 Affected: *.* |
| CVE-2024-13263 | 5.5 | Jan 9 | Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027 Affected: 0.0.0 before 3.1.1 |
| CVE-2024-13248 | 5.5 | Jan 9 | Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012 Affected: 0.0.0 before 2.1.0 |
| CVE-2026-84924 New | 5.4 | Oct 22 | Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125 Affected: 0.0.0 before 2.4.0 |
| CVE-2026-81163 New | 5.4 | Oct 22 | Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129 Affected: 0.0.0 before 2.1.6 |
| CVE-2026-87940 New | 5.4 | Oct 22 | Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138 Affected: 0.0.0 before 2.2.4 |
| CVE-2026-87945 New | 5.4 | Oct 22 | SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96370 New | 5.4 | Oct 22 | Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96371 New | 5.4 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96372 New | 5.4 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96388 New | 5.4 | Oct 22 | Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184 Affected: 0.0.0 before 3.0.4 |
| CVE-2026-73476 | 5.4 | Sep 2 | External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098 Affected: 0.0.0 before 2.0.13 |
| CVE-2026-81164 | 5.4 | Sep 2 | Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114 Affected: 0.0.0 before 2.1.5 |
| CVE-2026-55805 | 5.4 | Aug 25 | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012 Affected: 0.0.0 before 10.6.13; 11.3.0 before 11.3.14; 11.4.0 before 11.4.4; 0.0.0 before 11.0.*; 0.0.0 before 11.1.*; 0.0.0 before 11.2.* |
| CVE-2026-55808 | 5.4 | Jul 10 | Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009 Affected: 0.0.0 before 10.5.12; 10.6.0 before 10.6.11; 11.2.0 before 11.2.14; 11.3.0 before 11.3.12; 0.0.0 before 11.0.*; 0.0.0 before 11.1.* |
| CVE-2026-15085 | 5.4 | Jul 10 | AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076 Affected: 0.0.0 before 1.1.3 |
| CVE-2026-15084 | 5.4 | Jul 10 | UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075 Affected: 2.0.0 before 2.0.17 |
| CVE-2026-15082 | 5.4 | Jul 10 | Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073 Affected: 0.0.0 before 2.0.1 |
| CVE-2026-15079 | 5.4 | Jul 10 | Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070 Affected: 0.0.0 before 2.1.4 |
| CVE-2026-58591 | 5.4 | Jul 10 | Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069 Affected: 0.0.0 before 2.1.5; 0.0.0 before 2.2.0 |
| CVE-2026-58590 | 5.4 | Jul 10 | FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068 Affected: 0.0.0 before 1.6.0 |
| CVE-2026-58589 | 5.4 | Jul 10 | FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067 Affected: 0.0.0 before 1.6.0 |
| CVE-2026-11908 | 5.4 | Jul 10 | Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043 Affected: 0.0.0 before 1.2.52 |
| CVE-2026-10769 | 5.4 | Jul 10 | Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041 Affected: 3.3.0 before 3.3.6 |
| CVE-2026-4093 | 5.4 | May 21 | Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels) Affected: 7.x-1.x through 7.x-1.11 |
| CVE-2026-4929 | 5.4 | May 21 | Simple Hierarchical Select (Drupal 7) XSS in term-derived output Affected: 7.x-1.0 before 7.x-1.11 |
| CVE-2026-8493 | 5.4 | May 19 | Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036 Affected: 0.0.0 before 2.1.1 |
| CVE-2026-3215 | 5.4 | Mar 25 | Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016 Affected: 0.0.0 before 2.17.5 |
| CVE-2026-3212 | 5.4 | Mar 25 | Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013 Affected: 0.0.0 before 1.2.49 |
| CVE-2026-2348 | 5.4 | Mar 25 | Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009 Affected: 0.0.0 before 1.0.5; 2.0.0 before 2.0.1 |
The 500 most important CVEs for this product (exploited first, then by severity)