DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
545
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 39High 72Medium 256Low 30
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-16648 New | 3.8 | Oct 22 | Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128 Affected: 0.0.0 before 1.2.7 |
| CVE-2026-87951 New | 3.8 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96387 New | 3.8 | Oct 22 | Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183 Affected: 1.0 before 1.6 |
| CVE-2026-6816 | 3.8 | May 28 | TFA Basic Plugins - Access Bypass Affected: 7.x-1.0 through 7.x-1.2 |
| CVE-2024-13308 | 3.8 | Jan 9 | Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072 Affected: 1.0.0 before 2.0.2 |
| CVE-2026-84916 New | 3.7 | Oct 22 | Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126 Affected: 0.0.0 before 2.19.0 |
| CVE-2026-84918 New | 3.7 | Oct 22 | Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130 Affected: 0.0.0 before 1.0.3 |
| CVE-2026-81168 | 3.7 | Sep 2 | CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105 Affected: 0.0.0 before 1.0.2 |
| CVE-2026-81159 | 3.7 | Sep 2 | Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106 Affected: 0.0.0 before 1.10.0 |
| CVE-2026-8491 | 3.7 | May 19 | Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034 Affected: 0.0.0 before 1.7.0; 2.0.0 before 2.0.1 |
| CVE-2025-13083 | 3.7 | Nov 18 | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… Affected: 8.0.0 before 10.4.9; 10.5.0 before 10.5.6; 11.0.0 before 11.1.9; 11.2.0 before 11.2.8 |
| CVE-2026-87948 New | 3.5 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96360 New | 3.5 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96384 New | 3.5 | Oct 22 | Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180 Affected: 1.0.4 before 1.0.9 |
| CVE-2026-96392 New | 3.5 | Oct 22 | AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187 Affected: 0.0.0 before 1.4.3 |
| CVE-2024-13261 | 3.5 | Jan 9 | Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025 Affected: 0.0.0 before 1.0.13; 1.1.0 before 1.1.0-beta3 |
| CVE-2026-87949 New | 3.3 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-87953 New | 3.3 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96373 New | 3.3 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-81161 | 3.3 | Sep 2 | Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107 Affected: 0.0.0 before 3.9.0 |
| CVE-2026-13235 | 3.3 | Jul 10 | AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055 Affected: 0.0.0 before 1.2.17; 1.3.0 before 1.3.8; 1.4.0 before 1.4.3 |
| CVE-2026-13233 | 3.3 | Jul 10 | OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053 Affected: 0.0.0 before 1.1.1; 1.2.0 before 1.2.2 |
| CVE-2026-11909 | 3.3 | Jul 10 | Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044 Affected: 0.0.0 before 4.0.6 |
| CVE-2026-84911 New | 3.1 | Oct 22 | AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119 Affected: 0.0.0 before 1.3.13; 1.4.0 before 1.4.8 |
| CVE-2026-87952 New | 3.1 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96369 New | 3.1 | Oct 22 | Webform - Less critical - Access bypass - SA-CONTRIB-2026-165 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-55807 | 3.1 | Jul 10 | Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008 Affected: 0.0.0 before 10.5.12; 10.6.0 before 10.6.11; 11.2.0 before 11.2.14; 11.3.0 before 11.3.12; 0.0.0 before 11.0.*; 0.0.0 before 11.1.* |
| CVE-2026-13232 | 3.1 | Jul 10 | Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052 Affected: 0.0.0 before 2.8.0 |
| CVE-2024-13293 | 3.1 | Jan 9 | POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059 Affected: 0.0.0 before 1.0.2 |
| CVE-2026-8492 | 2.7 | May 19 | Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035 Affected: 0.0.0 before 3.0.5 |
Showing 30
The 500 most important CVEs for this product (exploited first, then by severity)