- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, Drupal recorded 221 security vulnerabilities in the last 90 days across 152 products, including 14 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Webform had the most security vulnerabilities in the Drupal ecosystem, with 20 vulnerabilities—approximately 9.05% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-110176File Force Download for Drupal 7 Access Bypass via Unconditional Download HeadersCVE-2026-96389Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206CVE-2026-77152Field Collection for Drupal 7 access bypass via missing parent entity access checkCVE-2026-118584Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289CVE-2026-118583Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-110176File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers | Exploitation statusNot confirmed | FixYes |
| Published10/31/2026 |
| SeverityHigh |
CVE-2026-96389Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206 | Exploitation statusNot exploited | FixYes | Affected productXray Audit | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-77152Field Collection for Drupal 7 access bypass via missing parent entity access check | Exploitation statusNot confirmed | FixYes | Affected productField Collection for Drupal 7 | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-118584Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289 | Exploitation statusNot confirmed | FixYes | Affected productField Permissions | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118583Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288 | Exploitation statusNot confirmed | FixYes | Affected productField Permissions | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118582CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281 | Exploitation statusNot confirmed | FixYes | Affected productCAPTCHA | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118576Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286 | Exploitation statusNot confirmed | FixYes | Affected productStage File Proxy | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118575Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285 | Exploitation statusNot confirmed | FixYes | Affected productSignature pad widget | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118574S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279 | Exploitation statusNot confirmed | FixYes | Affected productS3 File System | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118573OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290 | Exploitation statusNot confirmed | FixYes | Affected productOAuth2 Token Manager | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118572OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284 | Exploitation statusNot confirmed | FixYes | Affected productOAuth Login - OAuth OIDC SSO | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118571Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292 | Exploitation statusNot confirmed | FixYes | Affected productMedia Alias Display | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118570Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283 | Exploitation statusNot confirmed | FixYes | Affected productFasttoggle | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118569Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282 | Exploitation statusNot confirmed | FixYes | Affected productFasttoggle | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118568Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291 | Exploitation statusNot confirmed | FixYes | Affected productContent Sync (content-sync.io) | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118567Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280 | Exploitation statusNot confirmed | FixYes | Affected productBulk Update User Roles | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118565GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278 | Exploitation statusNot confirmed | FixNo | Affected productGroupEx PRO ( Daxko ) integration | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118564PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277 | Exploitation statusNot confirmed | FixNo | Affected productPayUmoney for Drupal Commerce | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118563CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276 | Exploitation statusNot confirmed | FixNo | Affected productCacheFlush | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118562Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275 | Exploitation statusNot confirmed | FixYes | Affected productSingle Content Sync | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118561Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274 | Exploitation statusNot confirmed | FixYes | Affected productSingle Content Sync | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118560Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265 | Exploitation statusNot confirmed | FixYes | Affected productCommerce Stripe | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118559Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264 | Exploitation statusNot confirmed | FixYes | Affected productCommerce Stripe | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118558Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263 | Exploitation statusNot confirmed | FixYes | Affected productCommerce Stripe | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118557Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262 | Exploitation statusNot confirmed | FixYes | Affected productCommerce Shipping | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118556Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261 | Exploitation statusNot confirmed | FixYes | Affected productCommerce Shipping | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118555Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260 | Exploitation statusNot confirmed | FixYes | Affected productCommerce License | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118554OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287 | Exploitation statusNot confirmed | FixYes | Affected productOpenID Connect Client | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118553AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273 | Exploitation statusNot confirmed | FixYes | Affected productAI (Artificial Intelligence) | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118552AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272 | Exploitation statusNot confirmed | FixYes | Affected productAI (Artificial Intelligence) | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118551AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271 | Exploitation statusNot confirmed | FixYes | Affected productAI (Artificial Intelligence) | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118550AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270 | Exploitation statusNot confirmed | FixYes | Affected productAI (Artificial Intelligence) | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118549AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269 | Exploitation statusNot confirmed | FixYes | Affected productAI (Artificial Intelligence) | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118548AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268 | Exploitation statusNot confirmed | FixYes | Affected productAI (Artificial Intelligence) | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118546AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267 | Exploitation statusNot confirmed | FixYes | Affected productAI (Artificial Intelligence) | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118545AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266 | Exploitation statusNot confirmed | FixYes | Affected productAI (Artificial Intelligence) | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118544Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259 | Exploitation statusNot confirmed | FixYes | Affected productCommerce Core | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118543Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258 | Exploitation statusNot confirmed | FixYes | Affected productCommerce Core | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118542Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257 | Exploitation statusNot confirmed | FixYes | Affected productCommerce Core | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118541Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256 | Exploitation statusNot confirmed | FixYes | Affected productCommerce Core | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118540Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255 | Exploitation statusNot confirmed | FixYes | Affected productCommerce Core | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-118539Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 | Exploitation statusNot exploited | FixYes | Affected productCommerce Core | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-114573Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253 | Exploitation statusNot confirmed | FixYes | Affected productMonster Menus | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114572Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249 | Exploitation statusNot exploited | FixYes | Affected productDomain Login Restrict | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-114571Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252 | Exploitation statusNot confirmed | FixYes | Affected productRabbit Hole | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114555Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250 | Exploitation statusNot exploited | FixYes | Affected productData field | Published10/30/2026 | SeverityLow |
|---|
CVE-2026-114554AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251 | Exploitation statusNot confirmed | FixYes | Affected productAI File to Text | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114553Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241 | Exploitation statusNot confirmed | FixYes | Affected productFrontend Editing | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114548ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247 | Exploitation statusNot confirmed | FixYes | Affected productImageAPI Optimize WebP | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114547TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246 | Exploitation statusNot confirmed | FixYes | Affected productTinyPNG | Published10/30/2026 | SeverityUnknown |
|---|
478 Results | Page 1 of 10