- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, Drupal recorded 221 security vulnerabilities in the last 90 days across 152 products, including 14 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Webform had the most security vulnerabilities in the Drupal ecosystem, with 20 vulnerabilities—approximately 9.05% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-73475Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095CVE-2026-73474Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097CVE-2026-18986Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094CVE-2026-16647Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111CVE-2026-55805Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-73475Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095 | Exploitation statusNot exploited | FixYes |
| Published09/02/2026 |
| SeverityCritical |
CVE-2026-73474Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097 | Exploitation statusNot exploited | FixYes | Affected productEntity Share Websub | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-18986Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094 | Exploitation statusNot exploited | FixYes | Affected productEntity Browser | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-16647Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111 | Exploitation statusNot exploited | FixYes | Affected productDisable Login Page | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-55805Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012 | Exploitation statusNot exploited | FixYes | Affected productDrupal core | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-18985Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093 | Exploitation statusNot exploited | FixYes | Affected productEdit in-place field | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-18261Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092 | Exploitation statusNot exploited | FixNo | Affected productPowerful Surveys | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-18260Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110 | Exploitation statusNot exploited | FixYes | Affected productDisable Login Page | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-18259Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090 | Exploitation statusNot exploited | FixYes | Affected productToken Content Access | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-16646PanKM - Critical - Unsupported - SA-CONTRIB-2026-083 | Exploitation statusNot exploited | FixNo | Affected productPanKM | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-16645PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088 | Exploitation statusNot exploited | FixYes | Affected productPhotoSwipe - Responsive JavaScript Modal Image Gallery | Published08/25/2026 | SeverityCritical |
|---|
CVE-2026-16644Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087 | Exploitation statusNot exploited | FixYes | Affected productWebform REST | Published08/25/2026 | SeverityCritical |
|---|
CVE-2026-16643Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086 | Exploitation statusNot exploited | FixNo | Affected productLunr exposed filters | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-16642Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085 | Exploitation statusNot exploited | FixNo | Affected productEmail Login OTP | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-16641Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084 | Exploitation statusNot exploited | FixNo | Affected productCommerce Elavon | Published08/25/2026 | SeverityCritical |
|---|
CVE-2026-16640Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082 | Exploitation statusNot exploited | FixYes | Affected productSearch API Autocomplete | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-16639Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081 | Exploitation statusNot exploited | FixYes | Affected productInternationalization Single Sign-On | Published08/25/2026 | SeverityCritical |
|---|
CVE-2026-16638Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080 | Exploitation statusNot exploited | FixYes | Affected productMedia Folders | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-15917Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011 | Exploitation statusNot exploited | FixYes | Affected productDrupal core | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-15916Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010 | Exploitation statusNot exploited | FixYes | Affected productDrupal core | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-15088Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089 | Exploitation statusNot exploited | FixNo | Affected productDevelopment Environment | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-9726Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038 | Exploitation statusNot exploited | FixYes | Affected productDrupal AlternativeCommerce (Basket) | Published07/10/2026 | SeverityCritical |
|---|
CVE-2026-58591Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069 | Exploitation statusNot exploited | FixYes | Affected productColorbox | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-58590FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068 | Exploitation statusNot exploited | FixYes | Affected productFlowDrop | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-58589FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067 | Exploitation statusNot exploited | FixYes | Affected productFlowDrop | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-58588Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066 | Exploitation statusNot exploited | FixYes | Affected productDrupal Canvas | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-58587Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065 | Exploitation statusNot exploited | FixYes | Affected productDrupal Canvas | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-55810Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050 | Exploitation statusNot exploited | FixYes | Affected productPlotly.js Graphing | Published07/10/2026 | SeverityHigh |
|---|
CVE-2026-55809Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049 | Exploitation statusNot exploited | FixYes | Affected productFlag attendance field | Published07/10/2026 | SeverityHigh |
|---|
CVE-2026-55808Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009 | Exploitation statusNot exploited | FixYes | Affected productDrupal core | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-55807Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008 | Exploitation statusNot exploited | FixYes | Affected productDrupal core | Published07/10/2026 | SeverityLow |
|---|
CVE-2026-55806Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007 | Exploitation statusNot exploited | FixYes | Affected productDrupal core | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-55804Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006 | Exploitation statusNot exploited | FixYes | Affected productDrupal core | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-55803Drupal core - Critical - PHP object injection - SA-CORE-2026-005 | Exploitation statusNot exploited | FixYes | Affected productDrupal core | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-15089Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079 | Exploitation statusNot exploited | FixNo | Affected productCommerce guest registration | Published07/10/2026 | SeverityCritical |
|---|
CVE-2026-15087Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078 | Exploitation statusNot exploited | FixNo | Affected productClean RESTful | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-15086Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077 | Exploitation statusNot exploited | FixNo | Affected productRaw Formatter [Meta Tag Formatter] | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-15085AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076 | Exploitation statusNot exploited | FixYes | Affected productAI SEO/GEO Analyzer | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-15084UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075 | Exploitation statusNot exploited | FixYes | Affected productUI Patterns (SDC in Drupal UI) | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-15083ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074 | Exploitation statusNot exploited | FixYes | Affected productECA: Event - Condition - Action | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-15082Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073 | Exploitation statusNot exploited | FixYes | Affected productSiteimprove Analytics | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-15081Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072 | Exploitation statusNot exploited | FixYes | Affected productLocation Selector | Published07/10/2026 | SeverityHigh |
|---|
CVE-2026-15080Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071 | Exploitation statusNot exploited | FixYes | Affected productRay Enterprise Translation | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-15079Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070 | Exploitation statusNot exploited | FixYes | Affected productLogin Disable | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-13244Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064 | Exploitation statusNot exploited | FixYes | Affected productTealium iQ Tag Management | Published07/10/2026 | SeverityHigh |
|---|
CVE-2026-13243Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063 | Exploitation statusNot exploited | FixYes | Affected productSalesforce Suite | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-13242Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062 | Exploitation statusNot exploited | FixYes | Affected productGeolocation Field | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-13241Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061 | Exploitation statusNot exploited | FixYes | Affected productParagraphs | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-13240Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060 | Exploitation statusNot exploited | FixYes | Affected productParagraphs | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-13239WissKI - Critical - Access bypass - SA-CONTRIB-2026-059 | Exploitation statusNot exploited | FixYes | Affected productWissKI | Published07/10/2026 | SeverityMedium |
|---|
478 Results | Page 5 of 10