Veille CVE

Recherche « Drupal drupal »

177 CVE

Critique 13 Élevée 10 Moyenne 123 Faible 26 Non évaluée 5 Exploitées (KEV) Tri : plus récentes « Drupal drupal » ✕
  1. CVE-2026-96398 4.3 Moyenne

    Drupal Webform

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  2. CVE-2026-96392 3.5 Faible

    Drupal AI CKEditor

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3.

  3. CVE-2026-96391 – Non évaluée

    Drupal Webform REST

    Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.

  4. CVE-2026-96390 4.3 Moyenne

    Drupal Editoria11y Accessibility Checker

    Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.

  5. CVE-2026-96388 5.4 Moyenne

    Drupal Tawk.to - Live chat application

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.

  6. CVE-2026-96387 3.8 Faible

    Drupal Stop administrator login

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.

  7. CVE-2026-96386 6.5 Moyenne

    Drupal Smart Content

    Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.

  8. CVE-2026-96385 6.5 Moyenne

    Drupal REST & JSON API Authentication for Drupal

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.

  9. CVE-2026-96384 3.5 Faible

    Drupal Mermaid Diagram Field

    Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.

  10. CVE-2026-96382 4.6 Moyenne

    Drupal Diba carousel slider

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2.

  11. CVE-2026-96380 6.5 Moyenne

    Drupal CSS Usage Analyzer

    Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.

  12. CVE-2026-96379 – Non évaluée

    Drupal CookieCuttr

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3.

  13. CVE-2026-96378 4.3 Moyenne

    Drupal Commerce Decoupled Checkout

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.

  14. CVE-2026-96377 5.3 Moyenne

    Drupal Combined image style

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.

  15. CVE-2026-96376 6.4 Moyenne

    Drupal Cloud

    Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.

  16. CVE-2026-96375 4.8 Moyenne

    Drupal Cloud

    Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.

  17. CVE-2026-96374 4.2 Moyenne

    Drupal Project Browser

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.

  18. CVE-2026-96373 3.3 Faible

    Drupal Webform

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  19. CVE-2026-96372 5.4 Moyenne

    Drupal Webform

    Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  20. CVE-2026-96371 5.4 Moyenne

    Drupal Webform

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  21. CVE-2026-96370 5.4 Moyenne

    Drupal Webform

    Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  22. CVE-2026-96369 3.1 Faible

    Drupal Webform

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  23. CVE-2026-96368 4.6 Moyenne

    Drupal Webform

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  24. CVE-2026-96367 4.6 Moyenne

    Drupal Webform

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  25. CVE-2026-96366 5.3 Moyenne

    Drupal Webform

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  26. CVE-2026-96365 7.5 Élevée

    Drupal Webform

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  27. CVE-2026-96364 5.3 Moyenne

    Drupal Webform

    Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  28. CVE-2026-96363 – Non évaluée

    Drupal Webform

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  29. CVE-2026-96362 4.2 Moyenne

    Drupal Webform

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  30. CVE-2026-96361 4.6 Moyenne

    Drupal Webform

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  31. CVE-2026-96360 3.5 Faible

    Drupal Webform

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  32. CVE-2026-96359 4.6 Moyenne

    Drupal Webform

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  33. CVE-2026-96358 4.6 Moyenne

    Drupal Webform

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  34. CVE-2026-96357 4.6 Moyenne

    Drupal Webform

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  35. CVE-2026-96356 5.3 Moyenne

    Drupal Webform

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  36. CVE-2026-96355 9.1 Critique

    Drupal Webform

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  37. CVE-2026-87955 4.3 Moyenne

    Drupal Ultimate Table Field

    Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.

  38. CVE-2026-87954 4.3 Moyenne

    Drupal Taxonomy Term Glossary

    Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0.

  39. CVE-2026-87953 3.3 Faible

    Drupal SAML SSO - Service Provider

    Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

  40. CVE-2026-87952 3.1 Faible

    Drupal SAML SSO - Service Provider

    Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

  41. CVE-2026-87951 3.8 Faible

    Drupal SAML SSO - Service Provider

    Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

  42. CVE-2026-87950 5.3 Moyenne

    Drupal SAML SSO - Service Provider

    Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

  43. CVE-2026-87949 3.3 Faible

    Drupal SAML SSO - Service Provider

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

  44. CVE-2026-87948 3.5 Faible

    Drupal SAML SSO - Service Provider

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

  45. CVE-2026-87947 4.8 Moyenne

    Drupal SAML SSO - Service Provider

    Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

  46. CVE-2026-87946 4.8 Moyenne

    Drupal SAML SSO - Service Provider

    Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

  47. CVE-2026-87945 5.4 Moyenne

    Drupal SAML SSO - Service Provider

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

  48. CVE-2026-87944 4.8 Moyenne

    Drupal SAML SSO - Service Provider

    Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

  49. CVE-2026-87943 6.5 Moyenne

    Drupal SAML SSO - Service Provider

    Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

  50. CVE-2026-87942 4.6 Moyenne

    Drupal SafeDelete

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.

  51. CVE-2026-87941 – Non évaluée

    Drupal Patreon

    Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.

  52. CVE-2026-87940 5.4 Moyenne

    Drupal Key auth

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.

  53. CVE-2026-87939 4.2 Moyenne

    Drupal Feed Block

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.

  54. CVE-2026-87938 – Non évaluée

    Drupal CSP log

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.

  55. CVE-2026-87937 6.5 Moyenne

    Drupal Central Authentication System (CAS) Server

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

  56. CVE-2026-87936 6.5 Moyenne

    Drupal amazee.ai Private AI Provider

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.

  57. CVE-2026-84924 5.4 Moyenne

    Drupal Email Verification / SMS Verification / OTP Verification

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

  58. CVE-2026-84923 6.5 Moyenne

    Drupal Email Verification / SMS Verification / OTP Verification

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

  59. CVE-2026-84921 5.3 Moyenne

    Drupal Webform Submissions Delete

    Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.

  60. CVE-2026-84920 5.3 Moyenne

    Drupal Unpublished Node Permissions

    Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.

  61. CVE-2026-84919 4.6 Moyenne

    Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.

  62. CVE-2026-84918 3.7 Faible

    Drupal Monobank payment API

    Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.

  63. CVE-2026-84917 6.5 Moyenne

    Drupal Jsonapi Role Access

    Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.

  64. CVE-2026-84916 3.7 Faible

    Drupal Islandora

    Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.

  65. CVE-2026-84915 4.6 Moyenne

    Drupal Component blocks

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.

  66. CVE-2026-84914 5.3 Moyenne

    Drupal Calculate Working Days

    Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.

  67. CVE-2026-84913 4.6 Moyenne

    Drupal AI Translate

    Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.

  68. CVE-2026-84912 4.6 Moyenne

    Drupal AI (Artificial Intelligence)

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

  69. CVE-2026-84911 3.1 Faible

    Drupal AI (Artificial Intelligence)

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

  70. CVE-2026-84910 4.2 Moyenne

    Drupal Advanced Search

    Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.

  71. CVE-2026-81163 5.4 Moyenne

    Drupal Media Library Importer

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.

  72. CVE-2026-16648 3.8 Faible

    Drupal Mailer Plus Log

    Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.

  73. CVE-2026-81269 5.3 Moyenne

    Drupal Data field · Data field project data field

    Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.

  74. CVE-2026-81205 5.3 Moyenne

    Drupal LDAP / Active Directory Integration · Miniorange ldap \/ active directory integration

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.

  75. CVE-2026-81201 6.1 Moyenne

    Drupal Monster Menus · Monster menus project monster menus

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.

  76. CVE-2026-81168 3.7 Faible

    Drupal CAPTCHA Protected Page · Captcha protected page project captcha protected page

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.

  77. CVE-2026-81167 4.8 Moyenne

    Drupal Address Suggestion · Address suggestion project address suggestion

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.

  78. CVE-2026-81166 5.3 Moyenne

    Drupal Digital Signage Framework · Lakedrops digital signage framework

    Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1.

  79. CVE-2026-81165 5.3 Moyenne

    Drupal Blazy · Blazy project blazy

    Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.

  80. CVE-2026-81164 5.4 Moyenne

    Drupal Entity PDF · Entity pdf project entity pdf

    Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.

  81. CVE-2026-81162 5.3 Moyenne

    Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal · Dxpr builder project dxpr builder

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1.

  82. CVE-2026-81161 3.3 Faible

    Drupal Content Moderation Notifications · Content moderation notifications project content moderation notifications

    Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.

  83. CVE-2026-81160 6.1 Moyenne

    Drupal Slick Carousel · Slick carousel project slick carousel

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0.

  84. CVE-2026-81159 3.7 Faible

    Drupal Commerce CyberSource · Centarro commerce cybersource

    Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.

  85. CVE-2026-81158 5.3 Moyenne

    Drupal Entity API · Entity api project entity api

    Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.

  86. CVE-2026-76782 7.3 Élevée

    Drupal Screenshot

    Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.

  87. CVE-2026-76759 7.3 Élevée

    Drupal Screenshot

    Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.

  88. CVE-2026-76758 5.9 Moyenne

    Drupal Link content parser

    Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*.

  89. CVE-2026-76757 5.9 Moyenne

    Drupal Gammu SMS Daemon

    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

  90. CVE-2026-76756 5.9 Moyenne

    Drupal Gammu SMS Daemon

    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

  91. CVE-2026-76755 5.9 Moyenne

    Drupal Gammu SMS Daemon

    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

  92. CVE-2026-73478 5.3 Moyenne

    Drupal Diff · Diff project diff

    Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

  93. CVE-2026-73477 5.3 Moyenne

    Drupal Quick Tabs · Quick tabs project quick tabs

    Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.

  94. CVE-2026-73476 5.4 Moyenne

    Drupal External Authentication · External authentication project external authentication

    Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.

  95. CVE-2026-73475 9.1 Critique

    Drupal Commerce PayPal · Centarro commerce paypal

    Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.

  96. CVE-2026-73474 5.3 Moyenne

    Drupal Entity Share Websub · Entity share websub project entity share websub

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.

  97. CVE-2026-18986 4.8 Moyenne

    Drupal Entity Browser · Entity browser project entity browser

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.

  98. CVE-2026-16647 4.1 Moyenne

    Drupal Disable Login Page · Zyxware disable login page

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

  99. CVE-2026-55805 5.4 Moyenne

    Drupal core

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

  100. CVE-2026-18985 8.1 Élevée

    Drupal Edit in-place field

    Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.

  101. CVE-2026-18261 5.7 Moyenne

    Drupal Powerful Surveys

    Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.

  102. CVE-2026-18260 5.7 Moyenne

    Drupal Disable Login Page

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

  103. CVE-2026-18259 7.5 Élevée

    Drupal Token Content Access

    Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.

  104. CVE-2026-16646 5.7 Moyenne

    Drupal PanKM

    Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.

  105. CVE-2026-16645 9.1 Critique

    Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery

    Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.

  106. CVE-2026-16644 9.1 Critique

    Drupal Webform REST

    Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

  107. CVE-2026-16643 5.7 Moyenne

    Drupal Lunr exposed filters

    Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.

  108. CVE-2026-16642 5.7 Moyenne

    Drupal Email Login OTP

    Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.

  109. CVE-2026-16641 9.8 Critique

    Drupal Commerce Elavon

    Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.

  110. CVE-2026-16640 6.1 Moyenne

    Drupal Search API Autocomplete

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.

  111. CVE-2026-16639 9.8 Critique

    Drupal Internationalization Single Sign-On

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.

  112. CVE-2026-16638 6.1 Moyenne

    Drupal Media Folders

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.

  113. CVE-2026-15917 4.7 Moyenne

    Drupal core

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.

  114. CVE-2026-15916 4.2 Moyenne

    Drupal core

    Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

  115. CVE-2026-15088 5.7 Moyenne

    Drupal Development Environment

    Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.

  116. CVE-2026-15089 9.1 Critique

    Drupal Commerce guest registration

    Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*.

  117. CVE-2026-15087 5.9 Moyenne

    Drupal Clean RESTful

    vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.

  118. CVE-2026-15086 5.9 Moyenne

    Drupal Raw Formatter [Meta Tag Formatter]

    vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.

  119. CVE-2026-11915 5.9 Moyenne

    Drupal Brute force attack protection

    vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.

  120. CVE-2026-11914 5.9 Moyenne

    Drupal Composer

    vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

  121. CVE-2026-11913 9.8 Critique

    Drupal Mother May I

    vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.

  122. CVE-2026-58591 5.4 Moyenne

    Drupal Colorbox · Colorbox project colorbox

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.

  123. CVE-2026-58590 5.4 Moyenne

    Drupal FlowDrop · Flowdrop project flowdrop

    Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

  124. CVE-2026-58589 5.4 Moyenne

    Drupal FlowDrop · Flowdrop project flowdrop

    Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

  125. CVE-2026-58588 6.1 Moyenne

    Drupal Canvas · Drupal canvas project drupal canvas

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.

  126. CVE-2026-58587 6.1 Moyenne

    Drupal Canvas · Drupal canvas project drupal canvas

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.

  127. CVE-2026-55810 8.1 Élevée

    Drupal Plotly.js Graphing · Plotly plotly.js graphing

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.

  128. CVE-2026-55809 8.1 Élevée

    Drupal Flag attendance field · Flag attendance field project flag attendance field

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2.

  129. CVE-2026-55808 5.4 Moyenne

    Drupal core · Drupal drupal

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

  130. CVE-2026-55807 3.1 Faible

    Drupal core · Drupal drupal

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

  131. CVE-2026-55806 5.9 Moyenne

    Drupal core · Drupal drupal

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

  132. CVE-2026-55804 5.9 Moyenne

    Drupal core · Drupal drupal

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

  133. CVE-2026-55803 5.9 Moyenne

    Drupal core · Drupal drupal

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

  134. CVE-2026-15085 5.4 Moyenne

    Drupal AI SEO/GEO Analyzer · J-vee ai seo\/geo analyzer

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.

  135. CVE-2026-15084 5.4 Moyenne

    Drupal UI Patterns (SDC in Drupal UI) · Ademarco ui patterns

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.

  136. CVE-2026-15083 4.2 Moyenne

    Drupal ECA: Event - Condition - Action · Jurgenhaas eca\

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4.

  137. CVE-2026-15082 5.4 Moyenne

    Drupal Siteimprove Analytics · Ijsbrandy siteimprove analytics

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.

  138. CVE-2026-15081 7.4 Élevée

    Drupal Location Selector · Handkerchief location selector

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue affects Location Selector versions: from 0.0.0 to 1.3.0.

  139. CVE-2026-15080 4.3 Moyenne

    Drupal Ray Enterprise Translation · Lingotek ray enterprise translation

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4.

  140. CVE-2026-15079 5.4 Moyenne

    Drupal Login Disable · Budda login disable

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.

  141. CVE-2026-13244 8.1 Élevée

    Drupal Tealium iQ Tag Management · Dakku tealium iq tag management

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.

  142. CVE-2026-13243 4.8 Moyenne

    Drupal Salesforce Suite · Victorkane salesforce suite

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.

  143. CVE-2026-13242 6.5 Moyenne

    Drupal Geolocation Field · Dopry geolocation field

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.

  144. CVE-2026-13241 6.5 Moyenne

    Drupal Paragraphs · Md-systems paragraphs

    Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

  145. CVE-2026-13240 6.5 Moyenne

    Drupal Paragraphs · Md-systems paragraphs

    Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

  146. CVE-2026-13239 6.5 Moyenne

    Drupal WissKI · Wiss-ki wisski

    Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.

  147. CVE-2026-13238 4.8 Moyenne

    Drupal Commerce Realex / Global Payments · Stella commerce realex \/ global payments

    Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payments versions: from 0.0.0 to 3.0.2.

  148. CVE-2026-13237 4.8 Moyenne

    Drupal AI Agents · Artificial intelligence project artificial intelligence

    Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

  149. CVE-2026-13236 4.2 Moyenne

    Drupal AI Agents · Artificial intelligence project artificial intelligence

    Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

  150. CVE-2026-13235 3.3 Faible

    Drupal AI (Artificial Intelligence) · Artificial intelligence project artificial intelligence

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.