Drupal Vulnerabilities & CVE List (Nov 2026) | CyStack

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Drupal Vulnerabilities & CVE List (Nov 2026) | CyStack

CVE-2026-13238Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058

Exploitation status: Not exploited
Fix: Yes
Affected product: Commerce Realex / Global Payments
Published: 07/10/2026
Severity: Medium

CVE-2026-13237AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057

Exploitation status: Not exploited
Fix: Yes
Affected product: AI Agents
Published: 07/10/2026
Severity: Medium

CVE-2026-13236AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056

Exploitation status: Not exploited
Fix: Yes
Affected product: AI Agents
Published: 07/10/2026
Severity: Medium

CVE-2026-13235AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055

Exploitation status: Not exploited
Fix: Yes
Affected product: AI (Artificial Intelligence)
Published: 07/10/2026
Severity: Low

CVE-2026-13234AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054

Exploitation status: Not exploited
Fix: Yes
Affected product: AI (Artificial Intelligence)
Published: 07/10/2026
Severity: Medium

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-13238`Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058	Exploitation statusNot exploited	FixYes

`CVE-2026-13237`AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057	Exploitation statusNot exploited	FixYes	Affected productAI Agents	Published07/10/2026	SeverityMedium

`CVE-2026-13235`AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055	Exploitation statusNot exploited	FixYes	Affected productAI (Artificial Intelligence)	Published07/10/2026	SeverityLow

`CVE-2026-13234`AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054	Exploitation statusNot exploited	FixYes	Affected productAI (Artificial Intelligence)	Published07/10/2026	SeverityMedium

`CVE-2026-13233`OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053	Exploitation statusNot exploited	FixYes	Affected productOpenAI Provider	Published07/10/2026	SeverityLow

`CVE-2026-13232`Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052	Exploitation statusNot exploited	FixYes	Affected productAdvanced Content Feedback (aka admin_feedback)	Published07/10/2026	SeverityLow

`CVE-2026-13231`Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051	Exploitation statusNot exploited	FixYes	Affected productAdvanced Content Feedback (aka admin_feedback)	Published07/10/2026	SeverityMedium

`CVE-2026-11915`Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047	Exploitation statusNot exploited	FixNo	Affected productBrute force attack protection	Published07/10/2026	SeverityMedium

`CVE-2026-11909`Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044	Exploitation statusNot exploited	FixYes	Affected productExamples for Developers	Published07/10/2026	SeverityLow

`CVE-2026-10768`LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039	Exploitation statusNot exploited	FixYes	Affected productLocalGov Workflows	Published07/10/2026	SeverityCritical

`CVE-2026-5343`SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031	Exploitation statusNot exploited	FixYes	Affected productSAML SSO - Service Provider	Published05/28/2026	SeverityHigh

`CVE-2026-4929`Simple Hierarchical Select (Drupal 7) XSS in term-derived output	Exploitation statusActively exploited	FixYes	Affected productSimple Hierarchical Select (shs)	Published05/21/2026	SeverityMedium

`CVE-2026-4093`Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels)	Exploitation statusNot exploited	FixYes	Affected productTerm Reference Tree	Published05/21/2026	SeverityMedium

`CVE-2026-8492`Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035	Exploitation statusNot exploited	FixYes	Affected productTranslate Drupal with GTranslate	Published05/19/2026	SeverityLow

`CVE-2026-4933`Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029	Exploitation statusNot exploited	FixYes	Affected productUnpublished Node Permissions	Published03/26/2026	SeverityHigh

`CVE-2026-4393`Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030	Exploitation statusNot exploited	FixYes	Affected productAutomated Logout	Published03/26/2026	SeverityMedium

`CVE-2026-3573`AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028	Exploitation statusNot exploited	FixYes	Affected productAI (Artificial Intelligence)	Published03/26/2026	SeverityHigh

`CVE-2026-3532`Case-Sensitivity Validation Flaw in Drupal OpenID Connect / OAuth Client Can Cause Duplicate Emails and Access Bypass	Exploitation statusNot exploited	FixYes	Affected productOpenID Connect / OAuth client	Published03/26/2026	SeverityMedium

`CVE-2026-3531`OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026	Exploitation statusNot exploited	FixYes	Affected productOpenID Connect / OAuth client	Published03/26/2026	SeverityMedium

`CVE-2026-3530`OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025	Exploitation statusNot exploited	FixYes	Affected productOpenID Connect / OAuth client	Published03/26/2026	SeverityMedium

`CVE-2026-3529`Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024	Exploitation statusNot exploited	FixYes	Affected productGoogle Analytics GA4	Published03/26/2026	SeverityMedium

`CVE-2026-3528`Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023	Exploitation statusNot exploited	FixYes	Affected productCalculation Fields	Published03/26/2026	SeverityMedium

`CVE-2026-3526`File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021	Exploitation statusNot exploited	FixYes	Affected productFile Access Fix (deprecated)	Published03/26/2026	SeverityMedium

`CVE-2026-3525`File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020	Exploitation statusNot exploited	FixYes	Affected productFile Access Fix (deprecated)	Published03/26/2026	SeverityMedium

`CVE-2026-0748`Access bypass in Drupal 7 i18n_node translation UI	Exploitation statusActively exploited	FixYes	Affected productInternationalization (i18n) - i18n_node submodule	Published03/26/2026	SeverityMedium

`CVE-2026-3218`Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019	Exploitation statusNot exploited	FixYes	Affected productResponsive Favicons	Published03/25/2026	SeverityMedium

`CVE-2026-3217`SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018	Exploitation statusNot exploited	FixYes	Affected productSAML SSO - Service Provider	Published03/25/2026	SeverityMedium

`CVE-2026-3216`Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017	Exploitation statusNot exploited	FixYes	Affected productDrupal Canvas	Published03/25/2026	SeverityMedium

`CVE-2026-3215`Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016	Exploitation statusNot exploited	FixYes	Affected productIslandora	Published03/25/2026	SeverityMedium

`CVE-2026-3213`Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014	Exploitation statusNot exploited	FixYes	Affected productAnti-Spam by CleanTalk	Published03/25/2026	SeverityMedium