- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, Drupal recorded 221 security vulnerabilities in the last 90 days across 152 products, including 14 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Webform had the most security vulnerabilities in the Drupal ecosystem, with 20 vulnerabilities—approximately 9.05% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-114546Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245CVE-2026-114545Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244CVE-2026-114544Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243CVE-2026-114543Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239CVE-2026-114542Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-114546Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245 | Exploitation statusNot confirmed | FixYes |
| Affected productMedia Alias Display |
| Published10/30/2026 |
| SeverityUnknown |
CVE-2026-114545Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244 | Exploitation statusNot confirmed | FixYes | Affected productFullcalendar View | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114544Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243 | Exploitation statusNot confirmed | FixYes | Affected productMedia Bulk Upload | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114543Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239 | Exploitation statusNot confirmed | FixYes | Affected productSimple User Management | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114542Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242 | Exploitation statusNot confirmed | FixYes | Affected productSimple OAuth (OAuth2) & OpenID Connect | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114541Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240 | Exploitation statusNot confirmed | FixYes | Affected productFrontend Editing | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114540Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238 | Exploitation statusNot confirmed | FixYes | Affected productDomain | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114539DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237 | Exploitation statusNot confirmed | FixNo | Affected productDocCheck Basic | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114538Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236 | Exploitation statusNot confirmed | FixYes | Affected productBootstrap | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114537View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235 | Exploitation statusNot confirmed | FixYes | Affected productView Unpublished | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114536USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234 | Exploitation statusNot confirmed | FixYes | Affected productUSWDS Paragraph Components | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114535Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233 | Exploitation statusNot confirmed | FixYes | Affected productSwiper formatter | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114534Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232 | Exploitation statusNot confirmed | FixYes | Affected productBlock Attributes | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114533Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231 | Exploitation statusNot confirmed | FixYes | Affected productÁgora Transparency Theme | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114532UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230 | Exploitation statusNot confirmed | FixYes | Affected productUI Icons | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114531Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228 | Exploitation statusNot confirmed | FixYes | Affected productSwiper formatter | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114530Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227 | Exploitation statusNot confirmed | FixYes | Affected productDopup | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114529CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226 | Exploitation statusNot confirmed | FixYes | Affected productCSV Field | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114528Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222 | Exploitation statusNot confirmed | FixYes | Affected productZero Point | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114527UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221 | Exploitation statusNot confirmed | FixYes | Affected productUI Icons | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114526Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223 | Exploitation statusNot confirmed | FixYes | Affected productBlack Hole | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114525ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224 | Exploitation statusNot confirmed | FixYes | Affected productABC | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114524Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225 | Exploitation statusNot confirmed | FixYes | Affected productCustom Formatters | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-114523Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220 | Exploitation statusNot confirmed | FixYes | Affected productFfmpeg Image Toolkit | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-110738Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219 | Exploitation statusNot confirmed | FixYes | Affected productGin Admin Theme | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-108515Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015 | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-108514Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016 | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-108099Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218 | Exploitation statusNot confirmed | FixYes | Affected productEntity List | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-108097Drupal core - Critical - Remote code execution - SA-CORE-2026-014 | Exploitation statusNot exploited | FixYes | Affected productDrupal core | Published10/30/2026 | SeverityHigh |
|---|
CVE-2026-107312Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215 | Exploitation statusNot exploited | FixYes | Affected productExamples for Developers | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-107311Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214 | Exploitation statusNot exploited | FixYes | Affected productPermissions by Term | Published10/30/2026 | SeverityLow |
|---|
CVE-2026-107310Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213 | Exploitation statusNot exploited | FixYes | Affected productFreelinking | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-107309Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212 | Exploitation statusNot exploited | FixYes | Affected productEasy Breadcrumb | Published10/30/2026 | SeverityLow |
|---|
CVE-2026-107308Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211 | Exploitation statusNot exploited | FixYes | Affected productCountry | Published10/30/2026 | SeverityLow |
|---|
CVE-2026-107307SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210 | Exploitation statusNot exploited | FixYes | Affected productSmartLinker AI | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-107306Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209 | Exploitation statusNot exploited | FixYes | Affected productMenu Link Attributes | Published10/30/2026 | SeverityLow |
|---|
CVE-2026-107268Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207 | Exploitation statusNot exploited | FixYes | Affected productTwo Factor Authentication - TFA / Passwordless Login | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-107267DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208 | Exploitation statusNot exploited | FixYes | Affected productDKAN | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-107266Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205 | Exploitation statusNot confirmed | FixYes | Affected productViews Share | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-107265Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204 | Exploitation statusNot exploited | FixYes | Affected productLeaflet | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-107264Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203 | Exploitation statusNot exploited | FixYes | Affected productInline Formatter Field | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-107263Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202 | Exploitation statusNot exploited | FixYes | Affected productGutenberg | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-107262Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217 | Exploitation statusNot exploited | FixYes | Affected productAdvanced Filesystem | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-107261Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201 | Exploitation statusNot exploited | FixYes | Affected productAuthenticator Login Plus (2FA) | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-107260Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229 | Exploitation statusNot confirmed | FixYes | Affected productSector Distribution | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-107259Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200 | Exploitation statusNot exploited | FixYes | Affected productLinked Field | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-107258Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199 | Exploitation statusNot exploited | FixYes | Affected productInline Entity Form Dialog | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-107257Actstream - Critical - Access bypass - SA-CONTRIB-2026-198 | Exploitation statusNot exploited | FixYes | Affected productActstream | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-107256Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248 | Exploitation statusNot confirmed | FixYes | Affected productShield | Published10/30/2026 | SeverityUnknown |
|---|
CVE-2026-107255Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216 | Exploitation statusNot confirmed | FixYes | Affected productRestrict route by IP | Published10/30/2026 | SeverityUnknown |
|---|
478 Results | Page 2 of 10