- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, Drupal recorded 221 security vulnerabilities in the last 90 days across 152 products, including 14 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Webform had the most security vulnerabilities in the Drupal ecosystem, with 20 vulnerabilities—approximately 9.05% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2025-8093Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098CVE-2025-8996Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097CVE-2025-8995Authenticator Login - Highly critical - Access bypass - SA-CONTRIB-2025-096CVE-2025-8675AI SEO Link Advisor - Less critical - Server-side Request Forgery - SA-CONTRIB-2025-095CVE-2025-8362GoogleTag Manager - Moderately critical - Cross-site scripting - SA-CONTRIB-2025-094| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2025-8093Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098 | Exploitation statusNot exploited | FixYes |
| Published10/10/2025 |
| SeverityHigh |
CVE-2025-8996Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097 | Exploitation statusNot exploited | FixYes | Affected productLayout Builder Advanced Permissions | Published08/15/2025 | SeverityMedium |
|---|
CVE-2025-8995Authenticator Login - Highly critical - Access bypass - SA-CONTRIB-2025-096 | Exploitation statusNot exploited | FixYes | Affected productAuthenticator Login | Published08/15/2025 | SeverityCritical |
|---|
CVE-2025-8675AI SEO Link Advisor - Less critical - Server-side Request Forgery - SA-CONTRIB-2025-095 | Exploitation statusNot exploited | FixYes | Affected productAI SEO Link Advisor | Published08/15/2025 | SeverityMedium |
|---|
CVE-2025-8362GoogleTag Manager - Moderately critical - Cross-site scripting - SA-CONTRIB-2025-094 | Exploitation statusNot exploited | FixYes | Affected productGoogleTag Manager | Published08/15/2025 | SeverityMedium |
|---|
CVE-2025-8361Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093 | Exploitation statusNot exploited | FixYes | Affected productConfig Pages | Published08/15/2025 | SeverityHigh |
|---|
CVE-2025-8092COOKiES Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-092 | Exploitation statusNot exploited | FixYes | Affected productCOOKiES Consent Management | Published08/15/2025 | SeverityHigh |
|---|
CVE-2025-7717File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089 | Exploitation statusNot exploited | FixYes | Affected productFile Download | Published07/21/2025 | SeverityHigh |
|---|
CVE-2025-7716Real-time SEO for Drupal - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-091 | Exploitation statusNot exploited | FixYes | Affected productReal-time SEO for Drupal | Published07/21/2025 | SeverityMedium |
|---|
CVE-2025-7715Block Attributes - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-090 | Exploitation statusNot exploited | FixYes | Affected productBlock Attributes | Published07/21/2025 | SeverityMedium |
|---|
CVE-2025-7393Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088 | Exploitation statusNot exploited | FixYes | Affected productMail Login | Published07/21/2025 | SeverityCritical |
|---|
CVE-2025-7392Cookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087 | Exploitation statusNot exploited | FixYes | Affected productCookies Addons | Published07/21/2025 | SeverityMedium |
|---|
CVE-2025-7031Config Pages Viewer - Critical - Access bypass - SA-CONTRIB-2025-086 | Exploitation statusNot exploited | FixYes | Affected productConfig Pages Viewer | Published07/08/2025 | SeverityMedium |
|---|
CVE-2025-7030Two-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-085 | Exploitation statusNot exploited | FixYes | Affected productTwo-factor Authentication (TFA) | Published07/08/2025 | SeverityMedium |
|---|
CVE-2025-6677Paragraphs table - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-084 | Exploitation statusNot exploited | FixYes | Affected productParagraphs table | Published06/26/2025 | SeverityMedium |
|---|
CVE-2025-6676Simple XML sitemap - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-083 | Exploitation statusNot exploited | FixYes | Affected productSimple XML sitemap | Published06/26/2025 | SeverityMedium |
|---|
CVE-2025-6675Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-082 | Exploitation statusNot exploited | FixYes | Affected productEnterprise MFA - TFA for Drupal | Published06/26/2025 | SeverityMedium |
|---|
CVE-2025-6674CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081 | Exploitation statusNot exploited | FixYes | Affected productCKEditor5 Youtube | Published06/26/2025 | SeverityMedium |
|---|
CVE-2025-5682Klaro Cookie & Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-080 | Exploitation statusNot exploited | FixYes | Affected productKlaro Cookie & Consent Management | Published06/26/2025 | SeverityMedium |
|---|
CVE-2025-48923Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077 | Exploitation statusNot exploited | FixYes | Affected productToc.js | Published06/26/2025 | SeverityMedium |
|---|
CVE-2025-48922GLightbox - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-078 | Exploitation statusNot exploited | FixYes | Affected productGLightbox | Published06/26/2025 | SeverityMedium |
|---|
CVE-2025-48921Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079 | Exploitation statusNot exploited | FixYes | Affected productOpen Social | Published06/26/2025 | SeverityHigh |
|---|
CVE-2025-48920etracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074 | Exploitation statusNot exploited | FixYes | Affected productetracker | Published06/13/2025 | SeverityHigh |
|---|
CVE-2025-48919Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-073 | Exploitation statusNot exploited | FixYes | Affected productSimple Klaro | Published06/13/2025 | SeverityMedium |
|---|
CVE-2025-48918Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071 | Exploitation statusNot exploited | FixYes | Affected productSimple Klaro | Published06/13/2025 | SeverityHigh |
|---|
CVE-2025-48917EU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072 | Exploitation statusNot exploited | FixYes | Affected productEU Cookie Compliance (GDPR Compliance) | Published06/13/2025 | SeverityMedium |
|---|
CVE-2025-48915COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-076 | Exploitation statusNot exploited | FixYes | Affected productCOOKiES Consent Management | Published06/13/2025 | SeverityHigh |
|---|
CVE-2025-48914COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075 | Exploitation statusNot exploited | FixYes | Affected productCOOKiES Consent Management | Published06/13/2025 | SeverityHigh |
|---|
CVE-2025-48009Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060 | Exploitation statusNot exploited | FixYes | Affected productSingle Content Sync | Published05/21/2025 | SeverityLow |
|---|
CVE-2025-47710Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-056 | Exploitation statusNot exploited | FixYes | Affected productEnterprise MFA - TFA for Drupal | Published05/14/2025 | SeverityHigh |
|---|
CVE-2025-47709Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055 | Exploitation statusNot exploited | FixYes | Affected productEnterprise MFA - TFA for Drupal | Published05/14/2025 | SeverityMedium |
|---|
CVE-2025-47708Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054 | Exploitation statusNot exploited | FixYes | Affected productEnterprise MFA - TFA for Drupal | Published05/14/2025 | SeverityHigh |
|---|
CVE-2025-47707Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-053 | Exploitation statusNot exploited | FixYes | Affected productEnterprise MFA - TFA for Drupal | Published05/14/2025 | SeverityHigh |
|---|
CVE-2025-47706Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052 | Exploitation statusNot exploited | FixYes | Affected productEnterprise MFA - TFA for Drupal | Published05/14/2025 | SeverityMedium |
|---|
CVE-2025-47704Klaro Cookie & Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-050 | Exploitation statusNot exploited | FixYes | Affected productKlaro Cookie & Consent Management | Published05/14/2025 | SeverityMedium |
|---|
CVE-2025-47703COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-049 | Exploitation statusNot exploited | FixYes | Affected productCOOKiES Consent Management | Published05/14/2025 | SeverityMedium |
|---|
CVE-2025-47701Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047 | Exploitation statusNot exploited | FixYes | Affected productRestrict route by IP | Published05/14/2025 | SeverityHigh |
|---|
CVE-2025-3900Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041 | Exploitation statusNot exploited | FixYes | Affected productColorbox | Published04/23/2025 | SeverityMedium |
|---|
CVE-2025-3734Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035 | Exploitation statusNot exploited | FixYes | Affected productStage File Proxy | Published04/16/2025 | SeverityMedium |
|---|
CVE-2025-3131ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031 | Exploitation statusNot exploited | FixYes | Affected productECA: Event - Condition - Action | Published04/09/2025 | SeverityMedium |
|---|
CVE-2025-3130Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029 | Exploitation statusNot exploited | FixYes | Affected productObfuscate | Published04/02/2025 | SeverityMedium |
|---|
CVE-2025-3129Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028 | Exploitation statusNot exploited | FixYes | Affected productAccess code | Published04/02/2025 | SeverityMedium |
|---|
CVE-2025-31694Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023 | Exploitation statusNot exploited | FixYes | Affected productTwo-factor Authentication (TFA) | Published03/31/2025 | SeverityHigh |
|---|
CVE-2025-31693AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022 | Exploitation statusNot exploited | FixYes | Affected productAI (Artificial Intelligence) | Published03/31/2025 | SeverityMedium |
|---|
CVE-2025-31692AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021 | Exploitation statusNot exploited | FixYes | Affected productAI (Artificial Intelligence) | Published03/31/2025 | SeverityHigh |
|---|
CVE-2025-31686Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015 | Exploitation statusNot exploited | FixYes | Affected productOpen Social | Published03/31/2025 | SeverityHigh |
|---|
CVE-2025-31685Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014 | Exploitation statusNot exploited | FixYes | Affected productOpen Social | Published03/31/2025 | SeverityCritical |
|---|
CVE-2025-31681Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009 | Exploitation statusNot exploited | FixYes | Affected productAuthenticator Login | Published03/31/2025 | SeverityCritical |
|---|
CVE-2025-31678AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004 | Exploitation statusNot exploited | FixYes | Affected productAI (Artificial Intelligence) | Published03/31/2025 | SeverityHigh |
|---|
CVE-2025-31677AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003 | Exploitation statusNot exploited | FixYes | Affected productAI (Artificial Intelligence) | Published03/31/2025 | SeverityHigh |
|---|
478 Results | Page 8 of 10