Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,212

Export CSV
CVE-2026-118541

Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Commerce Core
CVE-2026-118540

Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Commerce Core
CVE-2026-114571

Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252

Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Rabbit Hole
CVE-2026-118554

OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Openid Connect Client
CVE-2026-118572

OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Oauth Login - Oauth Oidc Sso
CVE-2026-118567

Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280

Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Bulk Update User Roles
CVE-2026-118553

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Artificial Intelligence
CVE-2026-118552

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Artificial Intelligence
CVE-2026-118558

Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Commerce Stripe
CVE-2026-118557

Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262

Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Commerce Shipping
CVE-2026-118556

Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261

Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Commerce Shipping
CVE-2026-118555

Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260

Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Commerce License
CVE-2026-118548

AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268

Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Artificial Intelligence
CVE-2026-118546

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Artificial Intelligence
CVE-2026-118545

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Artificial Intelligence
CVE-2026-118560

Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Commerce Stripe
CVE-2026-118543

Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Commerce Core
CVE-2026-114573

Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Monster Menus
CVE-2026-114554

AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251

Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Ai File To Text
CVE-2026-107256

Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Shield