- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, Drupal recorded 221 security vulnerabilities in the last 90 days across 152 products, including 14 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Webform had the most security vulnerabilities in the Drupal ecosystem, with 20 vulnerabilities—approximately 9.05% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-87947SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145CVE-2026-87946SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144CVE-2026-87945SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143CVE-2026-87944SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142CVE-2026-87943SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-87947SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145 | Exploitation statusNot exploited | FixYes |
| Affected productSAML SSO - Service Provider |
| Published10/22/2026 |
| SeverityMedium |
CVE-2026-87946SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144 | Exploitation statusNot exploited | FixYes | Affected productSAML SSO - Service Provider | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-87945SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143 | Exploitation statusNot exploited | FixYes | Affected productSAML SSO - Service Provider | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-87944SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142 | Exploitation statusNot exploited | FixYes | Affected productSAML SSO - Service Provider | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-87943SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141 | Exploitation statusNot exploited | FixYes | Affected productSAML SSO - Service Provider | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-87942SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140 | Exploitation statusNot exploited | FixYes | Affected productSafeDelete | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-87941Patreon - Critical - Unsupported - SA-CONTRIB-2026-139 | Exploitation statusNot exploited | FixNo | Affected productPatreon | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-87940Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138 | Exploitation statusNot exploited | FixYes | Affected productKey auth | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-87939Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137 | Exploitation statusNot exploited | FixYes | Affected productFeed Block | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-87938CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136 | Exploitation statusNot exploited | FixYes | Affected productCSP log | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-87937Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135 | Exploitation statusNot exploited | FixYes | Affected productCentral Authentication System (CAS) Server | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-87936amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134 | Exploitation statusNot exploited | FixYes | Affected productamazee.ai Private AI Provider | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-84924Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125 | Exploitation statusNot exploited | FixYes | Affected productEmail Verification / SMS Verification / OTP Verification | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-84923Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124 | Exploitation statusNot exploited | FixYes | Affected productEmail Verification / SMS Verification / OTP Verification | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-84921Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133 | Exploitation statusNot exploited | FixYes | Affected productWebform Submissions Delete | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-84920Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132 | Exploitation statusNot exploited | FixYes | Affected productUnpublished Node Permissions | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-84919PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131 | Exploitation statusNot exploited | FixYes | Affected productPhotoSwipe - Responsive JavaScript Modal Image Gallery | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-84918Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130 | Exploitation statusNot exploited | FixYes | Affected productMonobank payment API | Published10/22/2026 | SeverityLow |
|---|
CVE-2026-84917Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127 | Exploitation statusNot exploited | FixYes | Affected productJsonapi Role Access | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-84916Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126 | Exploitation statusNot exploited | FixYes | Affected productIslandora | Published10/22/2026 | SeverityLow |
|---|
CVE-2026-84915Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123 | Exploitation statusNot exploited | FixYes | Affected productComponent blocks | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-84914Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122 | Exploitation statusNot exploited | FixYes | Affected productCalculate Working Days | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-84913AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121 | Exploitation statusNot exploited | FixYes | Affected productAI Translate | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-84912AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120 | Exploitation statusNot exploited | FixYes | Affected productAI (Artificial Intelligence) | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-84911AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119 | Exploitation statusNot exploited | FixYes | Affected productAI (Artificial Intelligence) | Published10/22/2026 | SeverityLow |
|---|
CVE-2026-84910Drupal Advanced Search access control bypass can expose restricted block content | Exploitation statusNot exploited | FixYes | Affected productAdvanced Search | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-81163Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129 | Exploitation statusNot exploited | FixYes | Affected productMedia Library Importer | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-16648Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128 | Exploitation statusNot exploited | FixYes | Affected productMailer Plus Log | Published10/22/2026 | SeverityLow |
|---|
CVE-2026-81269Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108 | Exploitation statusNot exploited | FixYes | Affected productData field | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-81205LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115 | Exploitation statusNot exploited | FixYes | Affected productLDAP / Active Directory Integration | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-81201Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116 | Exploitation statusNot exploited | FixYes | Affected productMonster Menus | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-81168CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105 | Exploitation statusNot exploited | FixYes | Affected productCAPTCHA Protected Page | Published09/02/2026 | SeverityLow |
|---|
CVE-2026-81167Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103 | Exploitation statusNot exploited | FixYes | Affected productAddress Suggestion | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-81166Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109 | Exploitation statusNot exploited | FixYes | Affected productDigital Signage Framework | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-81165Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104 | Exploitation statusNot exploited | FixYes | Affected productBlazy | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-81164Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114 | Exploitation statusNot exploited | FixYes | Affected productEntity PDF | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-81162DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112 | Exploitation statusNot exploited | FixYes | Affected productDXPR Builder: The Best Editing (AI) Experience for Drupal | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-81161Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107 | Exploitation statusNot exploited | FixYes | Affected productContent Moderation Notifications | Published09/02/2026 | SeverityLow |
|---|
CVE-2026-81160Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117 | Exploitation statusNot exploited | FixYes | Affected productSlick Carousel | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-81159Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106 | Exploitation statusNot exploited | FixYes | Affected productCommerce CyberSource | Published09/02/2026 | SeverityLow |
|---|
CVE-2026-81158Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113 | Exploitation statusNot exploited | FixYes | Affected productEntity API | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-76782Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 | Exploitation statusNot exploited | FixNo | Affected productScreenshot | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-76759Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 | Exploitation statusNot exploited | FixNo | Affected productScreenshot | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-76758Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101 | Exploitation statusNot exploited | FixNo | Affected productLink content parser | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-76757Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 | Exploitation statusNot exploited | FixNo | Affected productGammu SMS Daemon | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-76756Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 | Exploitation statusNot exploited | FixNo | Affected productGammu SMS Daemon | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-76755Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 | Exploitation statusNot exploited | FixNo | Affected productGammu SMS Daemon | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-73478Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096 | Exploitation statusNot exploited | FixYes | Affected productDiff | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-73477Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099 | Exploitation statusNot exploited | FixYes | Affected productQuick Tabs | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-73476External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098 | Exploitation statusNot exploited | FixYes | Affected productExternal Authentication | Published09/02/2026 | SeverityMedium |
|---|
478 Results | Page 4 of 10