drupal vulnerabilities

Products

• drupal/drupal 237
• drupal/core 149
• drupal/webform 31
• drupal/ai 18
• Drupal core 15
• drupal/miniorange_saml 15
• AI (Artificial Intelligence) 13
• SAML SSO - Service Provider 13
• drupal/commerce 10
• Commerce Core 7
• drupal/miniorange_2fa 7
• drupal/core-recommended 6
• drupal/jsonapi 6
• drupal/permissions_by_term 6
• project issue tracking module 6
• drupal/facets 5
• drupal/gutenberg 5
• drupal/tfa 5
• print 5
• aggregation module 4
• Drupal Canvas 4
• drupal/apigee_edge 4
• drupal/canvas 4
• drupal/cleantalk 4
• drupal/cookies 4
• drupal/graphql 4
• drupal/group 4
• drupal/mail_login 4
• drupal/monster_menus 4
• drupal/openid_connect 4

Latest drupal CVEs

Newest publication first · page 1 of 40 · showing the latest 1,000

1. CVE-2026-110176 File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers

   Published 2026-10-31

   High·CVSS 8.7

   The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In version...

2. CVE-2026-77152 Field Collection for Drupal 7 access bypass via missing parent entity access check

   Published 2026-10-30

   Medium·CVSS 5.3

   Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity. The access check for field collection items (field_collection_item_access()) granted edit...

3. CVE-2026-107249 Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

   Published 2026-10-30

   Critical·CVSS 9.8 EPSS 0.39%

   Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

4. CVE-2026-107250 ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193

   Published 2026-10-30

   Medium·CVSS 5.9 EPSS 0.20%

   Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: ..

5. CVE-2026-107251 Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194

   Published 2026-10-30

   Medium·CVSS 6.5 EPSS 0.20%

   Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

6. CVE-2026-107252 MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195

   Published 2026-10-30

   Medium·CVSS 5.4 EPSS 0.15%

   Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.

7. CVE-2026-107253 Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196

   Published 2026-10-30

   Medium·CVSS 5.9 EPSS 0.20%

   Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: ..

8. CVE-2026-107254 Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197

   Published 2026-10-30

   Medium·CVSS 4.8 EPSS 0.22%

   Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

9. CVE-2026-107257 Actstream - Critical - Access bypass - SA-CONTRIB-2026-198

   Published 2026-10-30

   Medium·CVSS 6.5 EPSS 0.19%

   Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

10. CVE-2026-107258 Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

    Published 2026-10-30

    Medium·CVSS 5.4 EPSS 0.17%

    Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.

11. CVE-2026-107259 Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200

    Published 2026-10-30

    Medium·CVSS 5.4 EPSS 0.18%

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.

12. CVE-2026-107261 Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

    Published 2026-10-30

    Medium·CVSS 4.2 EPSS 0.19%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

13. CVE-2026-107263 Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202

    Published 2026-10-30

    Medium·CVSS 5.4 EPSS 0.17%

    Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.

14. CVE-2026-107264 Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203

    Published 2026-10-30

    Medium·CVSS 5.4 EPSS 0.18%

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.

15. CVE-2026-107265 Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204

    Published 2026-10-30

    Medium·CVSS 5.4 EPSS 0.18%

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.

16. CVE-2026-107266 Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205

    Published 2026-10-30

    Medium·CVSS 5.3 EPSS 0.28%

    Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.

17. CVE-2026-96389 Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

    Published 2026-10-30

    Medium·CVSS 6.5 EPSS 0.16%

    Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.

18. CVE-2026-107268 Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

    Published 2026-10-30

    Medium·CVSS 4.3 EPSS 0.30%

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.

19. CVE-2026-107267 DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

    Published 2026-10-30

    Medium·CVSS 5.3 EPSS 0.23%

    Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.

20. CVE-2026-107306 Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

    Published 2026-10-30

    Low·CVSS 3.8 EPSS 0.19%

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

21. CVE-2026-107307 SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210

    Published 2026-10-30

    Medium·CVSS 4.3 EPSS 0.20%

    Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.

22. CVE-2026-107308 Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

    Published 2026-10-30

    Low·CVSS 3.1 EPSS 0.15%

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

23. CVE-2026-107309 Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212

    Published 2026-10-30

    Low·CVSS 3.7 EPSS 0.20%

    Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.

24. CVE-2026-107310 Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213

    Published 2026-10-30

    Medium·CVSS 4.3 EPSS 0.20%

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.

25. CVE-2026-107311 Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214

    Published 2026-10-30

    Low·CVSS 3.7 EPSS 0.21%

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.