Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,212

Export CSV
CVE-2026-10768

LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039

Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Drupal Localgovdrupal
Products
Localgov Workflows Localgov Workflows
CVE-2026-9726

Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Alternativecommerce Drupal
Products
Alternativecommerce Drupal Alternativecommerce (basket)
CVE-2026-96376

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Cloud
CVE-2026-96355

Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-84924

Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Email Verification / Sms Verification / Otp Verification
CVE-2026-84920

Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Unpublished Node Permissions
CVE-2026-87942

SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Safedelete
CVE-2026-87940

Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Key Auth
CVE-2026-87939

Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Feed Block
CVE-2026-87937

Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Central Authentication System (cas) Server
CVE-2026-87936

amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Amazee.ai Private Ai Provider
CVE-2026-84921

Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform Submissions Delete
CVE-2026-84919

PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Photoswipe - Responsive Javascript Modal Image Gallery
CVE-2026-84918

Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130

Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Monobank Payment Api
CVE-2026-84917

Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Jsonapi Role Access
CVE-2026-84916

Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Islandora
CVE-2026-81163

Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Media Library Importer
CVE-2026-16648

Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128

Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Mailer Plus Log
CVE-2026-96385

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Rest & Json Api Authentication For Drupal
CVE-2026-96372

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167

Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform