Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,212

Export CSV
CVE-2026-107268

Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Two Factor Authentication - Tfa / Passwordless Login
CVE-2026-96389

Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Xray Audit
CVE-2026-107265

Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Leaflet
CVE-2026-107264

Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Inline Formatter Field
CVE-2026-107263

Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202

Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Gutenberg
CVE-2026-107261

Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Authenticator Login Plus (2fa)
CVE-2026-107259

Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Linked Field
CVE-2026-107258

Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Inline Entity Form Dialog
CVE-2026-107257

Actstream - Critical - Access bypass - SA-CONTRIB-2026-198

Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Actstream
CVE-2026-107254

Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Authenticator Login Plus (2fa)
CVE-2026-107252

MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Mathjax: Latex For Drupal
CVE-2026-107251

Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194

Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Entity Reference Manager (merge Entities)
CVE-2026-107250

ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193

Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Eca Helper
CVE-2026-107249

Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Block Ajax
CVE-2026-96379

CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Cookiecuttr
CVE-2026-96363

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-87938

CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Csp Log
CVE-2026-96391

Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-114555

Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Data Field
CVE-2026-107312

Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Examples For Developers