DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
680
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 44High 108Medium 347Low 1
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-84915 | 4.6 | Oct 22 | Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123 Affected: 0.0.0 before 1.2.7 |
| CVE-2026-84919 | 4.6 | Oct 22 | PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131 Affected: 0.0.0 before 5.0.9 |
| CVE-2026-87942 | 4.6 | Oct 22 | SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140 Affected: 0.0.0 before 1.0.88 |
| CVE-2026-96361 | 4.6 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96358 | 4.6 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96359 | 4.6 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96367 | 4.6 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96368 | 4.6 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96357 | 4.6 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96382 | 4.6 | Oct 22 | Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191 Affected: 0.0.0 before 3.0.2 |
| CVE-2025-31673 | 4.6 | Mar 31 | Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002 Affected: 8.0.0 before 10.3.13; 10.4.0 before 10.4.3; 11.0.0 before 11.0.12; 11.1.0 before 11.1.3 |
| CVE-2024-13304 | 4.5 | Jan 9 | Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070 Affected: 0.0.0 before 3.0.3 |
| CVE-2025-13981 | 4.4 | Jan 28 | AI (Artificial Intelligence) - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-119 Affected: 0.0.0 before 1.0.7; 1.1.0 before 1.1.7; 1.2.0 before 1.2.4 |
| CVE-2026-87954 | 4.3 | Oct 22 | Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152 Affected: 0.0.0 before 4.6.0 |
| CVE-2026-87955 | 4.3 | Oct 22 | Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153 Affected: 0.0.0 before 1.1.1; 2.0.0 before 2.0.1 |
| CVE-2026-96398 | 4.3 | Oct 22 | Webform - Less critical - Access bypass - SA-CONTRIB-2026-173 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96378 | 4.3 | Oct 22 | Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179 Affected: 1.0.0 before 1.8.0 |
| CVE-2026-96390 | 4.3 | Oct 22 | Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185 Affected: 0.0.0 before 2.2.23; 3.0.0 before 3.0.9 |
| CVE-2026-15080 | 4.3 | Jul 10 | Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071 Affected: 0.0.0 before 4.0.4; 4.1.0 before 4.1.4; 11.0.0 before 11.0.4 |
| CVE-2026-0748 | 4.3 | Mar 26 | Access bypass in Drupal 7 i18n_node translation UI Affected: 7.x-1.0 through 7.x-1.35 |
| CVE-2026-4393 | 4.3 | Mar 26 | Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030 Affected: 0.0.0 before 1.7.0; 2.0.0 before 2.0.2 |
| CVE-2026-3530 | 4.3 | Mar 26 | OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025 Affected: 0.0.0 before 1.5.0 |
| CVE-2026-3211 | 4.3 | Mar 25 | Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012 Affected: 0.0.0 before 1.2.1 |
| CVE-2026-1917 | 4.3 | Mar 25 | Login Disable - Less critical - Access bypass - SA-CONTRIB-2026-008 Affected: 0.0.0 before 2.1.3 |
| CVE-2025-13082 | 4.3 | Nov 18 | Drupal core - Moderately critical - Defacement - SA-CORE-2025-007 Affected: 8.0.0 before 10.4.9; 10.5.0 before 10.5.6; 11.0.0 before 11.1.9; 11.2.0 before 11.2.8 |
| CVE-2025-10930 | 4.3 | Oct 29 | Currency - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-110 Affected: 0.0.0 before 3.5.0 |
| CVE-2025-8996 | 4.3 | Aug 15 | Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097 Affected: 0.0.0 before 2.2.0 |
| CVE-2025-5682 | 4.3 | Jun 26 | Klaro Cookie & Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-080 Affected: 0.0.0 before 3.0.7 |
| CVE-2025-3907 | 4.3 | Apr 23 | Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046 Affected: 0.0.0 before 4.3.9 |
| CVE-2024-13288 | 4.3 | Jan 9 | Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052 Affected: 0.0.0 before 9.3.4; 9.4.0 before 9.4.2 |
| CVE-2024-13271 | 4.3 | Jan 9 | Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035 Affected: 0.0.0 before 1.0.4 |
| CVE-2024-13270 | 4.3 | Jan 9 | Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2024-034 Affected: 0.0.0 before 4.0.1 |
| CVE-2015-7880 | 4.3 | Sep 13 | The Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to obtain sensitive event registration information by leveraging the "Register other… Affected: 7.x-1.0; 7.x-1.0; 7.x-1.0; 7.x-1.1; 7.x-1.2; 7.x-1.3; +1 more |
| CVE-2016-9449 | 4.3 | Nov 25 | The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging… Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2016-7572 | 4.3 | Oct 3 | The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended… Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2016-7570 | 4.3 | Oct 3 | Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary… Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2026-84910 | 4.2 | Oct 22 | Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118 Affected: 0.0.0 before 2.4.5 |
| CVE-2026-87939 | 4.2 | Oct 22 | Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137 Affected: 0.0.0 before 2.0.2; 3.0.0 before 3.0.2 |
| CVE-2026-96362 | 4.2 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96374 | 4.2 | Oct 22 | Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178 Affected: 0.0.0 before 2.0.3; 2.1.0 before 2.1.5 |
| CVE-2026-15916 | 4.2 | Aug 25 | Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010 Affected: 0.0.0 before 10.6.13; 11.3.0 before 11.3.14; 11.4.0 before 11.4.4; 0.0.0 before 11.0.*; 0.0.0 before 11.1.*; 0.0.0 before 11.2.* |
| CVE-2026-15083 | 4.2 | Jul 10 | ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074 Affected: 0.0.0 before 2.1.20; 3.0.0 before 3.0.12; 3.1.0 before 3.1.4 |
| CVE-2026-13236 | 4.2 | Jul 10 | AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056 Affected: 0.0.0 before 1.1.4; 1.2.0 before 1.2.5; 1.3.0 before 1.3.1 |
| CVE-2026-3532 | 4.2 | Mar 26 | OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027 Affected: 0.0.0 before 1.5.0 |
| CVE-2026-1554 | 4.2 | Feb 4 | Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007 Affected: 0.0.0 before 2.0.3; 2.1.0 before 2.1.2 |
| CVE-2025-13986 | 4.2 | Jan 28 | Disable Login Page - Critical - Access bypass - SA-CONTRIB-2025-124 Affected: 0.0.0 before 1.1.3 |
| CVE-2026-16647 | 4.1 | Sep 2 | Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111 Affected: 0.0.0 before 1.1.4 |
The 500 most important CVEs for this product (exploited first, then by severity)