CVE-2026-16647Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111 Exploitation status Not known exploited Fix Affected product D Disable Login Page Published 09/02/2026 Severity Medium CVE-2026-18986Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094 Exploitation status Not known exploited Fix Affected product E Entity Browser Published 09/02/2026 Severity Medium CVE-2026-73475Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095 Exploitation status Not known exploited Fix Affected product C Commerce PayPal Published 09/02/2026 Severity Critical CVE-2026-73478Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096 Exploitation status Not known exploited Fix Affected product D Diff Published 09/02/2026 Severity Medium CVE-2026-73474Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097 Exploitation status Not known exploited Fix Affected product E Entity Share Websub Published 09/02/2026 Severity Medium CVE-2026-73476External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098 Exploitation status Not known exploited Fix Affected product E External Authentication Published 09/02/2026 Severity Medium CVE-2026-73477Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099 Exploitation status Not known exploited Fix Affected product Q Quick Tabs Published 09/02/2026 Severity Medium CVE-2026-76757Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 Exploitation status Not known exploited Fix Not confirmed Affected product G Gammu SMS Daemon Published 09/02/2026 Severity Medium CVE-2026-76756Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 Exploitation status Not known exploited Fix Not confirmed Affected product G Gammu SMS Daemon Published 09/02/2026 Severity Medium CVE-2026-76755Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 Exploitation status Not known exploited Fix Not confirmed Affected product G Gammu SMS Daemon Published 09/02/2026 Severity Medium CVE-2026-76758Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101 Exploitation status Not known exploited Fix Not confirmed Affected product L Link content parser Published 09/02/2026 Severity Medium CVE-2026-76782Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 Exploitation status Not known exploited Fix Not confirmed Affected product S Screenshot Published 09/02/2026 Severity High CVE-2026-76759Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 Exploitation status Not known exploited Fix Not confirmed Affected product S Screenshot Published 09/02/2026 Severity High CVE-2026-81167Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103 Exploitation status Not known exploited Fix Affected product A Address Suggestion Published 09/02/2026 Severity Medium CVE-2026-81165Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104 Exploitation status Not known exploited Fix Affected product B Blazy Published 09/02/2026 Severity Medium CVE-2026-81168CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105 Exploitation status Not known exploited Fix Affected product C CAPTCHA Protected Page Published 09/02/2026 Severity Low CVE-2026-81159Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106 Exploitation status Not known exploited Fix Affected product C Commerce CyberSource Published 09/02/2026 Severity Low CVE-2026-81161Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107 Exploitation status Not known exploited Fix Affected product C Content Moderation Notifications Published 09/02/2026 Severity Low CVE-2026-81269Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108 Exploitation status Not known exploited Fix Affected product D Data field Published 09/02/2026 Severity Medium CVE-2026-81166Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109 Exploitation status Not known exploited Fix Affected product D Digital Signage Framework Published 09/02/2026 Severity Medium CVE-2026-81162DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112 Exploitation status Not known exploited Fix Affected product D DXPR Builder: The Best Editing (AI) Experience for Drupal Published 09/02/2026 Severity Medium CVE-2026-81158Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113 Exploitation status Not known exploited Fix Affected product E Entity API Published 09/02/2026 Severity Medium CVE-2026-81164Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114 Exploitation status Not known exploited Fix Affected product E Entity PDF Published 09/02/2026 Severity Medium CVE-2026-81205LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115 Exploitation status Not known exploited Fix Affected product L LDAP / Active Directory Integration Published 09/02/2026 Severity Medium CVE-2026-81201Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116 Exploitation status Not known exploited Fix Affected product M Monster Menus Published 09/02/2026 Severity Medium CVE-2026-81160Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117 Exploitation status Not known exploited Fix Affected product S Slick Carousel Published 09/02/2026 Severity Medium CVE-2026-15916Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010 Exploitation status Not known exploited Fix Affected product D Drupal Core Published 08/25/2026 Severity Medium CVE-2026-15917Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011 Exploitation status Not known exploited Fix Affected product D Drupal Core Published 08/25/2026 Severity Medium CVE-2026-55805Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012 Exploitation status Not known exploited Fix Affected product D Drupal Core Published 08/25/2026 Severity Medium CVE-2026-16638Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080 Exploitation status Not known exploited Fix Affected product M Media Folders Published 08/25/2026 Severity Medium CVE-2026-16639Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081 Exploitation status Not known exploited Fix Affected product I Internationalization Single Sign-On Published 08/25/2026 Severity Critical CVE-2026-16640Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082 Exploitation status Not known exploited Fix Affected product S Search API Autocomplete Published 08/25/2026 Severity Medium CVE-2026-16646PanKM - Critical - Unsupported - SA-CONTRIB-2026-083 Exploitation status Not known exploited Fix Not confirmed Affected product P PanKM Published 08/25/2026 Severity Medium CVE-2026-16641Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084 Exploitation status Not known exploited Fix Not confirmed Affected product C Commerce Elavon Published 08/25/2026 Severity Critical CVE-2026-16642Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085 Exploitation status Not known exploited Fix Not confirmed Affected product E Email Login OTP Published 08/25/2026 Severity Medium CVE-2026-16643Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086 Exploitation status Not known exploited Fix Not confirmed Affected product L Lunr exposed filters Published 08/25/2026 Severity Medium CVE-2026-16644Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087 Exploitation status Not known exploited Fix Affected product W Webform REST Published 08/25/2026 Severity Critical CVE-2026-16645PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088 Exploitation status Not known exploited Fix Affected product P PhotoSwipe - Responsive JavaScript Modal Image Gallery Published 08/25/2026 Severity Critical CVE-2026-15088Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089 Exploitation status Not known exploited Fix Not confirmed Affected product D Development Environment Published 08/25/2026 Severity Medium CVE-2026-18259Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090 Exploitation status Not known exploited Fix Affected product T Token Content Access Published 08/25/2026 Severity High CVE-2026-18260Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110 Exploitation status Not known exploited Fix Affected product D Disable Login Page Published 08/25/2026 Severity Medium CVE-2026-18261Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092 Exploitation status Not known exploited Fix Not confirmed Affected product P Powerful Surveys Published 08/25/2026 Severity Medium CVE-2026-18985Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093 Exploitation status Not known exploited Fix Affected product E Edit in-place field Published 08/25/2026 Severity High CVE-2026-11913Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045 Exploitation status Not known exploited Fix Not confirmed Affected product M Mother May I Published 07/10/2026 Severity Critical CVE-2026-11914Composer - Critical - Unsupported - SA-CONTRIB-2026-046 Exploitation status Not known exploited Fix Not confirmed Affected product C Composer Published 07/10/2026 Severity Medium CVE-2026-11915Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047 Exploitation status Not known exploited Fix Not confirmed Affected product B Brute force attack protection Published 07/10/2026 Severity Medium CVE-2026-15087Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078 Exploitation status Not known exploited Fix Not confirmed Affected product C Clean RESTful Published 07/10/2026 Severity Medium CVE-2026-15086Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077 Exploitation status Not known exploited Fix Not confirmed Affected product R Raw Formatter [Meta Tag Formatter] Published 07/10/2026 Severity Medium CVE-2026-15089Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079 Exploitation status Not known exploited Fix Not confirmed Affected product C Commerce guest registration Published 07/10/2026 Severity Critical CVE-2026-55808Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009 Exploitation status Not known exploited Fix Affected product D Drupal Core Published 07/10/2026 Severity Medium CVE-2026-55807Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008 Exploitation status Not known exploited Fix Affected product D Drupal Core Published 07/10/2026 Severity Low CVE-2026-55806Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007 Exploitation status Not known exploited Fix Affected product D Drupal Core Published 07/10/2026 Severity Medium CVE-2026-55804Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006 Exploitation status Not known exploited Fix Affected product D Drupal Core Published 07/10/2026 Severity Medium CVE-2026-55803Drupal core - Critical - PHP object injection - SA-CORE-2026-005 Exploitation status Not known exploited Fix Affected product D Drupal Core Published 07/10/2026 Severity Medium CVE-2026-15085AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076 Exploitation status Not known exploited Fix Affected product A AI SEO/GEO Analyzer Published 07/10/2026 Severity Medium CVE-2026-15084UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075 Exploitation status Not known exploited Fix Affected product U UI Patterns (SDC in Drupal UI) Published 07/10/2026 Severity Medium CVE-2026-15083ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074 Exploitation status Not known exploited Fix Affected product E ECA: Event - Condition - Action Published 07/10/2026 Severity Medium CVE-2026-15082Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073 Exploitation status Not known exploited Fix Affected product S Siteimprove Analytics Published 07/10/2026 Severity Medium CVE-2026-15081Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072 Exploitation status Not known exploited Fix Affected product L Location Selector Published 07/10/2026 Severity High CVE-2026-15080Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071 Exploitation status Not known exploited Fix Affected product R Ray Enterprise Translation Published 07/10/2026 Severity Medium CVE-2026-15079Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070 Exploitation status Not known exploited Fix Affected product L Login Disable Published 07/10/2026 Severity Medium CVE-2026-58591Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069 Exploitation status Not known exploited Fix Affected product C Colorbox Published 07/10/2026 Severity Medium CVE-2026-58590FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068 Exploitation status Not known exploited Fix Affected product F FlowDrop Published 07/10/2026 Severity Medium CVE-2026-58589FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067 Exploitation status Not known exploited Fix Affected product F FlowDrop Published 07/10/2026 Severity Medium CVE-2026-58588Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066 Exploitation status Not known exploited Fix Affected product D Drupal Canvas Published 07/10/2026 Severity Medium CVE-2026-58587Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065 Exploitation status Not known exploited Fix Affected product D Drupal Canvas Published 07/10/2026 Severity Medium CVE-2026-13244Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064 Exploitation status Not known exploited Fix Affected product T Tealium iQ Tag Management Published 07/10/2026 Severity High CVE-2026-13243Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063 Exploitation status Not known exploited Fix Affected product S Salesforce Suite Published 07/10/2026 Severity Medium CVE-2026-13242Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062 Exploitation status Not known exploited Fix Affected product G Geolocation Field Published 07/10/2026 Severity Medium CVE-2026-13241Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061 Exploitation status Not known exploited Fix Affected product P Paragraphs Published 07/10/2026 Severity Medium CVE-2026-13240Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060 Exploitation status Not known exploited Fix Affected product P Paragraphs Published 07/10/2026 Severity Medium CVE-2026-13239WissKI - Critical - Access bypass - SA-CONTRIB-2026-059 Exploitation status Not known exploited Fix Affected product W WissKI Published 07/10/2026 Severity Medium CVE-2026-13238Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058 Exploitation status Not known exploited Fix Affected product C Commerce Realex / Global Payments Published 07/10/2026 Severity Medium CVE-2026-13237AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057 Exploitation status Not known exploited Fix Affected product A AI Agents Published 07/10/2026 Severity Medium CVE-2026-13236AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056 Exploitation status Not known exploited Fix Affected product A AI Agents Published 07/10/2026 Severity Medium CVE-2026-13235AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055 Exploitation status Not known exploited Fix Affected product A AI (Artificial Intelligence) Published 07/10/2026 Severity Low CVE-2026-13234AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054 Exploitation status Not known exploited Fix Affected product A AI (Artificial Intelligence) Published 07/10/2026 Severity Medium CVE-2026-13233OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053 Exploitation status Not known exploited Fix Affected product O OpenAI Provider Published 07/10/2026 Severity Low CVE-2026-13232Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052 Exploitation status Not known exploited Fix Affected product A Advanced Content Feedback (aka admin_feedback) Published 07/10/2026 Severity Low CVE-2026-13231Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051 Exploitation status Not known exploited Fix Affected product A Advanced Content Feedback (aka admin_feedback) Published 07/10/2026 Severity Medium CVE-2026-55810Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050 Exploitation status Not known exploited Fix Affected product P Plotly.js Graphing Published 07/10/2026 Severity High CVE-2026-55809Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049 Exploitation status Not known exploited Fix Affected product F Flag attendance field Published 07/10/2026 Severity High CVE-2026-12535Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048 Exploitation status Not known exploited Fix Affected product F Formatter Field Published 07/10/2026 Severity Critical CVE-2026-11909Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044 Exploitation status Not known exploited Fix Affected product E Examples for Developers Published 07/10/2026 Severity Low CVE-2026-11908Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043 Exploitation status Not known exploited Fix Affected product T Tagify Published 07/10/2026 Severity Medium CVE-2026-10770Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042 Exploitation status Not known exploited Fix Affected product A Anti-Spam by CleanTalk Published 07/10/2026 Severity Medium CVE-2026-10769Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041 Exploitation status Not known exploited Fix Affected product C Commerce Core Published 07/10/2026 Severity Medium CVE-2026-10768LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039 Exploitation status Not known exploited Fix Affected product L LocalGov Workflows Published 07/10/2026 Severity Critical CVE-2026-9726Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038 Exploitation status Not known exploited Fix Affected product D Drupal AlternativeCommerce (Basket) Published 07/10/2026 Severity Critical CVE-2026-6816TFA Basic Plugins - Access Bypass Exploitation status Public exploit Fix Not confirmed Affected product T TFA Basic Plugins Published 05/28/2026 Severity Medium CVE-2026-5343SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031 Exploitation status Not known exploited Fix Affected product S SAML SSO - Service Provider Published 05/28/2026 Severity High CVE-2026-4093Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels) Exploitation status Not known exploited Fix Affected product T Term Reference Tree Published 05/21/2026 Severity Medium CVE-2026-4929Simple Hierarchical Select (Drupal 7) XSS in term-derived output Exploitation status Public exploit Fix Affected product S Simple Hierarchical Select (shs) Published 05/21/2026 Severity Medium CVE-2026-9082Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 Exploitation status KEV Fix Affected product D Drupal Core Published 05/20/2026 Severity Critical CVE-2026-8495Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037 Exploitation status Not known exploited Fix Affected product D Date iCal Published 05/19/2026 Severity Critical CVE-2026-8493Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036 Exploitation status Not known exploited Fix Affected product C Colorbox Inline Published 05/19/2026 Severity Medium CVE-2026-8492Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035 Exploitation status Not known exploited Fix Affected product T Translate Drupal with GTranslate Published 05/19/2026 Severity Low CVE-2026-8491Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034 Exploitation status Not known exploited Fix Affected product N Node View Permissions Published 05/19/2026 Severity Low CVE-2026-6871Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033 Exploitation status Not known exploited Fix Affected product O Obfuscate Published 05/19/2026 Severity Medium CVE-2026-6367Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003 Exploitation status Not known exploited Fix Affected product D Drupal Core Published 05/19/2026 Severity Medium 
%20Experience%20for%20Drupal.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}
