Drupal Drupal is an Open Source CMS written in PHP

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Drupal product.

RSS Feeds for Drupal security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Drupal products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Drupal Sorted by Most Security Vulnerabilities since 2018

Drupal145 vulnerabilities
CMS

Drupal Artificial Intelligence8 vulnerabilities

Drupal Cookies Consent Management2 vulnerabilities

Drupal Jquery Ui Checkboxradio1 vulnerability

Drupal Wiki1 vulnerability

Drupal Web T1 vulnerability

Drupal Views Dynamic Field1 vulnerability

Drupal Svg Sanitizer1 vulnerability

Drupal Saml Sp 2 0 Single Sign On1 vulnerability

Drupal Responsive Menus1 vulnerability

Drupal Panels1 vulnerability

Drupal Obfuscate1 vulnerability

Drupal Entity Embed1 vulnerability

Drupal Eca1 vulnerability

Drupal Docker Images1 vulnerability

Drupal Avatar Uploader1 vulnerability

Drupal Authenticator Login1 vulnerability

Known Exploited Drupal Vulnerabilities

The following Drupal vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Drupal Core SQL Injection Vulnerability	Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. CVE-2026-9082 Exploit Probability: 33.7%	May 22, 2026
Drupal Core Remote Code Execution Vulnerability	A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site. CVE-2018-7602 Exploit Probability: 99.2%	April 13, 2022
Drupal Core Remote Code Execution Vulnerability	In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. CVE-2019-6340 Exploit Probability: 92.0%	March 25, 2022
Drupal core Un-restricted Upload of File	Improper sanitization in the extension file names is present in Drupal core. CVE-2020-13671 Exploit Probability: 36.2%	January 18, 2022
Drupal module configuration vulnerability	Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. CVE-2018-7600 Exploit Probability: 100.0%	November 3, 2021

Of the known exploited vulnerabilities above, 3 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 2 known exploited Drupal vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 221 vulnerabilities in Drupal with an average score of 5.6 out of ten. Last year, in 2025 Drupal had 44 security vulnerabilities published. That is, 177 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.35

Year	Vulnerabilities	Average Score
2026	221	5.56
2025	44	5.91
2024	12	6.30
2023	11	6.65
2022	20	7.11
2021	14	6.72
2020	9	8.00
2019	19	7.60
2018	5	7.88

It may take a day or so for new Drupal vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Drupal Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-84910	Oct 22, 2026	Drupal Advanced Search <2.4.6: Missing Auth Allows Forceful Browsing CVE-2026-84910 Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.
CVE-2026-84911	Oct 22, 2026	Drupal AI v0.0.0-1.4.8 Stored XSS in AI Component Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.	Artificial Intelligence
CVE-2026-84912	Oct 22, 2026	Missing Auth: Drupal AI v1.3.13, 1.4.01.4.8 Allow Forceful Browse Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.	Artificial Intelligence
CVE-2026-84913	Oct 22, 2026	Drupal AI Translate <1.4.2 Auth Bypass: Forceful Browse Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.
CVE-2026-84914	Oct 22, 2026	Drupal CWD 0.0.0-2.0.3 Missing Auth: Forceful Browsing Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.
CVE-2026-84915	Oct 22, 2026	Drupal Component Blocks Stored XSS v0.0.01.2.7 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.
CVE-2026-84923	Oct 22, 2026	Drupal Email/SMS/OTP Verification Auth Bypass via Alternate Path Pre2.4.0 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.
CVE-2026-84924	Oct 22, 2026	Drupal Email Verif. Reflected XSS v < 2.4.1 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.
CVE-2026-84916	Oct 22, 2026	Auth Bypass & Forceful Browsing in Drupal Islandora 0.0.02.19.0 Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.
CVE-2026-84917	Oct 22, 2026	Drupal Jsonapi Role Access <=2.0.2 Incorrect Auth Allows Forceful Browsing Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.
CVE-2026-16648	Oct 22, 2026	Drupal Mailer Plus Log 0.0.0-1.2.7 Log Injection Remote Credential Theft Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.
CVE-2026-81163	Oct 22, 2026	Drupal Media Lib Importer <=2.1.6 Path Traversal CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.
CVE-2026-84918	Oct 22, 2026	Drupal Monobank Payment API Signature Spoof (v<1.0.4) Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.
CVE-2026-84919	Oct 22, 2026	Drupal PhotoSwipe Stored XSS v0.0.0-5.0.9 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.
CVE-2026-84920	Oct 22, 2026	Drupal Unpublished Node Permissions 0.0.0-1.8.0 Incorrect Auth (Forceful Browsing) Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.
CVE-2026-84921	Oct 22, 2026	Drupal Webform Submissions Delete 1.2.0 Missing Auth: Force Browsing Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.
CVE-2026-87936	Oct 22, 2026	SQL Injection in Drupal amazee.ai Private AI Provider <1.4.4 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.
CVE-2026-87938	Oct 22, 2026	Drupal CSP log v0.0.01.0.2 SQLi via CSP log entry Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.
CVE-2026-87937	Oct 22, 2026	Drupal CAS Server <2.1.4: Open Redirect via URL Redirection URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.
CVE-2026-87939	Oct 22, 2026	Drupal Feed Block XSS (before v3.0.3) Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.
CVE-2026-87940	Oct 22, 2026	Drupal Key auth <=2.2.4: Browser Cache Leak via Access Control Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.
CVE-2026-87941	Oct 22, 2026	Drupal Patreon Module Unauthenticated Remote Code Exec (RCE) 7.x Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.
CVE-2026-87942	Oct 22, 2026	CVE-2026-87942: Drupal SafeDelete <=1.0.88 Stored XSS Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.
CVE-2026-87943	Oct 22, 2026	Missing Auth, Forceful Browsing - Drupal SAML SSO SP v<3.2.0 Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87944	Oct 22, 2026	Drupal SAML SSO SP Improper Cert Validation <=3.2.0 (AiTM) Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87945	Oct 22, 2026	Drupal SAML SSO SP Open Redirect (URL Redirection) 0.0.0-3.2.0 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87946	Oct 22, 2026	Timing Attack Brute-Force in Drupal SAML SSO - SP v0.0.0-3.2.0 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87947	Oct 22, 2026	Drupal SAML SSO Pro Improper Cryptographic Sign Verification (v0-3.2) Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87949	Oct 22, 2026	Drupal SAML SSO - Service Provider XSS (v <=3.2.0) Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87948	Oct 22, 2026	Drupal SAML SSO - Service Provider XSS (v <=3.2.0) Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87950	Oct 22, 2026	Hardcoded Credentials in Drupal SAML SSOSP (3.2.0) Exposes Sensitive Data Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87951	Oct 22, 2026	Insecure Storage of Sensitive Data in Drupal SAML SSO-SP v0-3.2.0 Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87952	Oct 22, 2026	Drupal SAML SSO Auth Bypass (capturereplay) v03.2.0 Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87954	Oct 22, 2026	Drupal Taxonomy Term Glossary (<4.6.0) Missing Auth & Forceful Browsing Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0.
CVE-2026-87953	Oct 22, 2026	Drupal SAML SSO - Service Provider SSRF (v <=3.2.0) Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87955	Oct 22, 2026	Drupal Ultimate Table Field <1.1.1, <2.0.2: Missing Auth & Forceful Browsing Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.
CVE-2026-96360	Oct 22, 2026	Drupal Webform XSS before 6.3.1 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96361	Oct 22, 2026	Drupal Webform ( 6.3.1) XSS Vulnerability Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96358	Oct 22, 2026	Drupal Webform XSS (v <6.3.2) CVE-2026-96358 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96362	Oct 22, 2026	Drupal Webform XSS Vulnerability (v0.0.0-6.3.1) Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96359	Oct 22, 2026	Drupal Webform XSS (CVE-2026-96359) before 6.3.2 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96363	Oct 22, 2026	Drupal Webform Stored XSS via Unsafe Actions before 6.3.2 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96367	Oct 22, 2026	Drupal Webform <6.3.1 Stored XSS via Priv Unsafe Actions Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96368	Oct 22, 2026	Drupal Webform <=6.3.1 XSS (Stored) Vulnerability Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96370	Oct 22, 2026	Drupal Webform v6.x SSRF via Incorrect Auth (CVE-2026-96370) Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96369	Oct 22, 2026	Drupal Webform Cache Exposure via Access Control Misconfig (v6.2.12 & 6.3.1) Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96371	Oct 22, 2026	Drupal Webform <=6.3.1 Stored XSS via Unsafe Actions Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96372	Oct 22, 2026	Drupal Webform <= 6.3.1: Insufficient Granularity Access Control Vulnerability Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96373	Oct 22, 2026	Drupal Webform <=6.3.1 Incorrect Auth Forced Browsing Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96366	Oct 22, 2026	Drupal Webform <=6.3.1 Incorrect Auth Forceful Browsing Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.