Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,212

Export CSV
CVE-2026-11915

Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047

vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Brute Force Attack Protection
CVE-2026-11914

Composer - Critical - Unsupported - SA-CONTRIB-2026-046

vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Composer
CVE-2026-11909

Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044

Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Drupal Rfay
Products
Examples For Developers Examples For Developers
CVE-2026-11913

Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045

vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Mother May I
CVE-2026-13237

AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057

Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Artificial Intelligence Project Drupal
Products
Artificial Intelligence Ai Agents
CVE-2026-58588

Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal Drupal Canvas Project
Products
Drupal Canvas Drupal Canvas
CVE-2026-58591

Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Colorbox Project Drupal
Products
Colorbox Colorbox
CVE-2026-15082

Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal Ijsbrandy
Products
Siteimprove Analytics Siteimprove Analytics
CVE-2026-15083

ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal Jurgenhaas
Products
Eca:event - Condition - Action Eca\
CVE-2026-15084

UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ademarco Drupal
Products
Ui Patterns Ui Patterns (sdc In Drupal Ui)
CVE-2026-15085

AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal J-vee
Products
Ai Seo/geo Analyzer Ai Seo\/geo Analyzer
CVE-2026-55803

Drupal core - Critical - PHP object injection - SA-CORE-2026-005

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Drupal Drupal Core
CVE-2026-55804

Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Drupal Drupal Core
CVE-2026-55807

Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Drupal Drupal Core
CVE-2026-55808

Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Drupal Drupal Core
CVE-2026-55806

Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Drupal Drupal Core
CVE-2026-15081

Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue affects Location Selector versions: from 0.0.0 to 1.3.0.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Drupal Handkerchief
Products
Location Selector Location Selector
CVE-2026-12535

Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Drupal Zroger
Products
Formatter Field Formatter Field