Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,212

Export CSV
CVE-2026-87945

SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Saml Sso - Service Provider
CVE-2026-87944

SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142

Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Saml Sso - Service Provider
CVE-2026-87943

SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Saml Sso - Service Provider
CVE-2026-84923

Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Email Verification / Sms Verification / Otp Verification
CVE-2026-84915

Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Component Blocks
CVE-2026-84914

Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122

Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Calculate Working Days
CVE-2026-96380

CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Css Usage Analyzer
CVE-2026-96398

Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96357

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96356

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96366

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96364

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171

Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96374

Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Project Browser
CVE-2026-96373

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96378

Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Commerce Decoupled Checkout
CVE-2026-96384

Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180

Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Mermaid Diagram Field
CVE-2026-96390

Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185

Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Editoria11y Accessibility Checker
CVE-2026-96365

Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96375

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Cloud
CVE-2026-96388

Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Tawk.to - Live Chat Application