drupal/ai vulnerabilities

Latest drupal/ai CVEs

Newest publication first

1. CVE-2026-118545 AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266

   Published 2026-10-30

   Medium·CVSS 6.5 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

2. CVE-2026-118546 AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267

   Published 2026-10-30

   Medium·CVSS 6.5 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

3. CVE-2026-118548 AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268

   Published 2026-10-30

   Low·CVSS 3.7 EPSS 0.20%

   Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

4. CVE-2026-118549 AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269

   Published 2026-10-30

   High·CVSS 7.1 EPSS 0.19%

   Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

5. CVE-2026-118550 AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270

   Published 2026-10-30

   Medium·CVSS 5.9 EPSS 0.33%

   Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1....

6. CVE-2026-118551 AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271

   Published 2026-10-30

   Low·CVSS 3.1 EPSS 0.19%

   Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

7. CVE-2026-118552 AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272

   Published 2026-10-30

   Medium·CVSS 6.5 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

8. CVE-2026-118553 AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273

   Published 2026-10-30

   Medium·CVSS 5.5 EPSS 0.15%

   Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

9. CVE-2026-84911 AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119

   Published 2026-10-22

   Low·CVSS 3.1 EPSS 0.19%

   Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

10. CVE-2026-84912 AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120

    Published 2026-10-22

    Medium·CVSS 4.6 EPSS 0.19%

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

11. CVE-2026-13235 AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055

    Published 2026-07-10

    Low·CVSS 3.3 EPSS 0.21%

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.

12. CVE-2026-13234 AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054

    Published 2026-07-10

    Medium·CVSS 6.1 EPSS 0.25%

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1...

13. CVE-2026-3573 AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028

    Published 2026-03-26

    High·CVSS 7.5 EPSS 0.25%

    Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.1.11, from 1.2.0 before 1.2.12.

14. CVE-2025-13981 AI (Artificial Intelligence) - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-119

    Published 2026-01-28

    Medium·CVSS 4.4 EPSS 0.14%

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.7, from 1.1.0 before 1.1.7, from 1.2....

15. CVE-2025-31693 AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022

    Published 2025-03-31

    Medium·CVSS 6.6 EPSS 0.76%

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

16. CVE-2025-31692 AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021

    Published 2025-03-31

    High·CVSS 7.5 EPSS 0.77%

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

17. CVE-2025-31678 AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

    Published 2025-03-31

    High·CVSS 8.2 EPSS 0.38%

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.

18. CVE-2025-31677 AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

    Published 2025-03-31

    High·CVSS 8.8 EPSS 0.23%

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Intelligence): from 1.0.0 before 1.0.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.