DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
586
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 39High 81Medium 286Low 32
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-96356 New | 5.3 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96377 New | 5.3 | Oct 22 | Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188 Affected: 0.0.0 before 1.0.7 |
| CVE-2026-73478 | 5.3 | Sep 2 | Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096 Affected: 0.0.0 before 2.0.1; 2.1.0 before 2.1.1 |
| CVE-2026-73474 | 5.3 | Sep 2 | Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097 Affected: 0.0.0 before 1.1.2 |
| CVE-2026-73477 | 5.3 | Sep 2 | Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099 Affected: 0.0.0 before 4.3.1 |
| CVE-2026-81165 | 5.3 | Sep 2 | Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104 Affected: 0.0.0 before 3.0.18 |
| CVE-2026-81269 | 5.3 | Sep 2 | Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108 Affected: 0.0.0 before 2.0.13 |
| CVE-2026-81166 | 5.3 | Sep 2 | Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109 Affected: 0.0.0 before 2.6.1 |
| CVE-2026-81162 | 5.3 | Sep 2 | DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112 Affected: 0.0.0 before 2.8.1 |
| CVE-2026-81158 | 5.3 | Sep 2 | Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113 Affected: 0.0.0 before 1.8.0 |
| CVE-2026-81205 | 5.3 | Sep 2 | LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115 Affected: 0.0.0 before 2.2.1 |
| CVE-2026-3526 | 5.3 | Mar 26 | File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021 Affected: 0.0.0 before 1.2.0 |
| CVE-2026-3525 | 5.3 | Mar 26 | File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020 Affected: 0.0.0 before 1.2.0 |
| CVE-2026-3210 | 5.3 | Mar 25 | Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011 Affected: 0.0.0 before 2.0.4 |
| CVE-2026-0944 | 5.3 | Feb 4 | Group invite - Moderately critical - Access bypass - SA-CONTRIB-2026-001 Affected: 0.0.0 before 2.3.9; 3.0.0 before 3.0.4; 4.0.0 before 4.0.4 |
| CVE-2025-13985 | 5.3 | Jan 28 | Entity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123 Affected: 0.0.0 before 3.13.0 |
| CVE-2025-13980 | 5.3 | Jan 28 | CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118 Affected: 0.0.0 before 1.2.10; 1.3.0 before 1.3.6; 1.4.0 before 1.4.3; 1.5.0 before 1.5.1; 1.6.0 before 1.6.4 |
| CVE-2025-13080 | 5.3 | Nov 18 | Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005 Affected: 8.0.0 before 10.4.9; 10.5.0 before 10.5.6; 11.0.0 before 11.1.9; 11.2.0 before 11.2.8 |
| CVE-2025-10929 | 5.3 | Oct 29 | Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111 Affected: 0.0.0 before 1.1.2 |
| CVE-2025-9554 | 5.3 | Oct 10 | Owl Carousel 2 - Critical - Unsupported - SA-CONTRIB-2025-104 Affected: *.* |
| CVE-2025-9553 | 5.3 | Oct 10 | API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103 Affected: *.* |
| CVE-2025-9552 | 5.3 | Oct 10 | Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102 Affected: *.* |
| CVE-2024-13312 | 5.3 | Jan 9 | Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076 Affected: 11.8.0 before 12.3.10; 12.4.0 before 12.4.9 |
| CVE-2024-13303 | 5.3 | Jan 9 | Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069 Affected: 0.0.0 before 2.0.2 |
| CVE-2024-13302 | 5.3 | Jan 9 | Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068 Affected: 2.0.0 before 2.0.3 |
| CVE-2024-13290 | 5.3 | Jan 9 | OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056 Affected: 0.0.0 before 2.0.4 |
| CVE-2024-13275 | 5.3 | Jan 9 | Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039 Affected: 0.0.0 before 2.0.3 |
| CVE-2024-13274 | 5.3 | Jan 9 | Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038 Affected: 0.0.0 before 12.3.8; 12.4.0 before 12.4.5 |
| CVE-2024-13269 | 5.3 | Jan 9 | Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033 Affected: 0.0.0 before 4.0.11 |
| CVE-2024-13266 | 5.3 | Jan 9 | Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030 Affected: 0.0.0 before 4.4.4 |
| CVE-2024-13257 | 5.3 | Jan 9 | Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021 Affected: 0.0.0 before 1.0.3 |
| CVE-2024-13246 | 5.3 | Jan 9 | Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010 Affected: 0.0.0 before 2.0.2 |
| CVE-2024-45440 | 5.3 | Aug 29 | core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist Affected: 2023-05-09 |
| CVE-2020-13667 | 5.3 | May 17 | Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions Affected: 8.8.0 before 8.8.10; 8.9.0 before 8.9.6; 9.0.0 before 9.0.6 |
| CVE-2017-6928 | 5.3 | Mar 1 | Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or… Affected: 7.0 before 7.57 |
| CVE-2016-6212 | 5.3 | Sep 9 | The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2016-3170 | 5.3 | Apr 12 | The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2026-3216 | 5.0 | Mar 25 | Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017 Affected: 0.0.0 before 1.1.1 |
| CVE-2026-87944 New | 4.8 | Oct 22 | SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-87946 New | 4.8 | Oct 22 | SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-87947 New | 4.8 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96375 New | 4.8 | Oct 22 | Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176 Affected: 0.0.0 before 7.0.1 |
| CVE-2026-18986 | 4.8 | Sep 2 | Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094 Affected: 0.0.0 before 2.16.0 |
| CVE-2026-81167 | 4.8 | Sep 2 | Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103 Affected: 0.0.0 before 1.0.25 |
| CVE-2026-13243 | 4.8 | Jul 10 | Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063 Affected: 0.0.0 before 5.1.3 |
| CVE-2026-13238 | 4.8 | Jul 10 | Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058 Affected: 0.0.0 before 3.0.2 |
| CVE-2026-13237 | 4.8 | Jul 10 | AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057 Affected: 0.0.0 before 1.1.4; 1.2.0 before 1.2.5; 1.3.0 before 1.3.1 |
| CVE-2026-3218 | 4.8 | Mar 25 | Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019 Affected: 0.0.0 before 2.0.2 |
| CVE-2026-1553 | 4.8 | Feb 4 | Drupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-006 Affected: 0.0.0 before 1.0.4 |
| CVE-2026-0947 | 4.8 | Feb 4 | AT Internet Piano Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-004 Affected: 0.0.0 before 1.0.1; 2.0.0 before 2.3.1 |
The 500 most important CVEs for this product (exploited first, then by severity)