Drupal Vulnerabilities & CVE List (Nov 2026) | CyStack

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Drupal Vulnerabilities & CVE List (Nov 2026) | CyStack

CVE-2026-107254Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197

Exploitation status: Not exploited
Fix: Yes
Affected product: Authenticator Login Plus (2FA)
Published: 10/30/2026
Severity: Medium

CVE-2026-107253Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196

Exploitation status: Not exploited
Fix: -
Affected product: Orphans Media
Published: 10/30/2026
Severity: Medium

CVE-2026-107252MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195

Exploitation status: Not exploited
Fix: Yes
Affected product: MathJax: LaTeX for Drupal
Published: 10/30/2026
Severity: Medium

CVE-2026-107251Improper Authorization in Drupal Entity Reference Manager (Merge entities) Enables Unauthorized Entity Deletion

Exploitation status: Not confirmed
Fix: Yes
Affected product: Entity Reference Manager (Merge entities)
Published: 10/30/2026
Severity: Unknown

CVE-2026-107250ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193

Exploitation status: Not exploited
Fix: -
Affected product: ECA Helper
Published: 10/30/2026
Severity: Medium

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-107254`Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197	Exploitation statusNot exploited	FixYes

`CVE-2026-107252`MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195	Exploitation statusNot exploited	FixYes	Affected productMathJax: LaTeX for Drupal	Published10/30/2026	SeverityMedium

`CVE-2026-107251`Improper Authorization in Drupal Entity Reference Manager (Merge entities) Enables Unauthorized Entity Deletion	Exploitation statusNot confirmed	FixYes	Affected productEntity Reference Manager (Merge entities)	Published10/30/2026	SeverityUnknown

`CVE-2026-96392`AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187	Exploitation statusNot exploited	FixYes	Affected productAI CKEditor	Published10/22/2026	SeverityLow

`CVE-2026-96390`Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185	Exploitation statusNot exploited	FixYes	Affected productEditoria11y Accessibility Checker	Published10/22/2026	SeverityMedium

`CVE-2026-96388`Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184	Exploitation statusNot exploited	FixYes	Affected productTawk.to - Live chat application	Published10/22/2026	SeverityMedium

`CVE-2026-96387`Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183	Exploitation statusNot exploited	FixYes	Affected productStop administrator login	Published10/22/2026	SeverityLow

`CVE-2026-96385`REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182	Exploitation statusNot exploited	FixYes	Affected productREST & JSON API Authentication for Drupal	Published10/22/2026	SeverityMedium

`CVE-2026-96384`Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180	Exploitation statusNot exploited	FixYes	Affected productMermaid Diagram Field	Published10/22/2026	SeverityLow

`CVE-2026-96382`Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191	Exploitation statusNot exploited	FixYes	Affected productDiba carousel slider	Published10/22/2026	SeverityMedium

`CVE-2026-96380`CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189	Exploitation statusNot exploited	FixYes	Affected productCSS Usage Analyzer	Published10/22/2026	SeverityMedium

`CVE-2026-96378`Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179	Exploitation statusNot exploited	FixYes	Affected productCommerce Decoupled Checkout	Published10/22/2026	SeverityMedium

`CVE-2026-96377`Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188	Exploitation statusNot exploited	FixYes	Affected productCombined image style	Published10/22/2026	SeverityMedium

`CVE-2026-96370`Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164	Exploitation statusNot exploited	FixYes	Affected productWebform	Published10/22/2026	SeverityMedium

`CVE-2026-87953`SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151	Exploitation statusNot exploited	FixYes	Affected productSAML SSO - Service Provider	Published10/22/2026	SeverityLow

`CVE-2026-87952`SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150	Exploitation statusNot exploited	FixYes	Affected productSAML SSO - Service Provider	Published10/22/2026	SeverityLow

`CVE-2026-87951`SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149	Exploitation statusNot exploited	FixYes	Affected productSAML SSO - Service Provider	Published10/22/2026	SeverityLow

`CVE-2026-87950`SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148	Exploitation statusNot exploited	FixYes	Affected productSAML SSO - Service Provider	Published10/22/2026	SeverityMedium

`CVE-2026-87949`SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147	Exploitation statusNot exploited	FixYes	Affected productSAML SSO - Service Provider	Published10/22/2026	SeverityLow

`CVE-2026-87948`SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146	Exploitation statusNot exploited	FixYes	Affected productSAML SSO - Service Provider	Published10/22/2026	SeverityLow