VulnSea

Drupal has 184 CVEs on record between 2018 and 2026. Disclosure cadence is accelerating: 182 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 178. The median CVSS is 4.8 (medium), with 4 rated critical. 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-79 (45) and CWE-863 (35). Most affected products: Webform (20), SAML SSO - Service Provider (11), AI (Artificial Intelligence) (10).

CVEs per month

Last 12 months, by publish date

120102030405060708091011
Exploited share
1% vs 1% corpus
Median CVSS
4.8
Publish → KEV
—(2)
Last 90 days
182 prev 1

Products

  • Webform 20
  • SAML SSO - Service Provider 11
  • AI (Artificial Intelligence) 10
  • Commerce Core 6
  • Commerce Stripe 3
  • Drupal core 3
Follow Drupal:RSS feedSave a search →Embed badge ↗
184
Total CVEs
4
Critical
2
CISA KEV
2
Exploited

Worst active — by depth score

Drupal vulnerabilities

CVEs affecting Drupal, newest first. Open any entry for full detail, references, and exploit status.

184 CVEsRSS

CVE-2026-114546None
6d ago

Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to…

▾ SunlitDrupal · Media Alias DisplayEPSS 0.15%via CVEORG
CVE-2026-114547None
6d ago

TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246

Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.

▾ SunlitDrupal · TinyPNGEPSS 0.14%via CVEORG
CVE-2026-114545None
6d ago

Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244

Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing. This issue affects Fullcalendar View versions: from 0.0.0 to 5.2.6.

▾ SunlitDrupal · Fullcalendar ViewEPSS 0.14%via CVEORG
CVE-2026-114554None
6d ago

AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251

Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.

▾ SunlitDrupal · AI File to TextEPSS 0.14%via CVEORG
CVE-2026-114548None
6d ago

ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.…

▾ SunlitDrupal · ImageAPI Optimize WebPEPSS 0.15%via CVEORG
CVE-2026-114571None
6d ago

Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252

Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.

▾ SunlitDrupal · Rabbit HoleEPSS 0.14%via CVEORG
CVE-2026-107256None
6d ago

Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.

▾ SunlitDrupal · ShieldEPSS 0.18%via CVEORG
CVE-2026-118540None
6d ago

Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.

▾ SunlitDrupal · Commerce CoreEPSS 0.15%via CVEORG
CVE-2026-114573None
6d ago

Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.

▾ SunlitDrupal · Monster MenusEPSS 0.24%via CVEORG
CVE-2026-118542None
6d ago

Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

▾ SunlitDrupal · Commerce CoreEPSS 0.15%via CVEORG
CVE-2026-118541None
6d ago

Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

▾ SunlitDrupal · Commerce CoreEPSS 0.15%via CVEORG
CVE-2026-118544None
6d ago

Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259

Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

▾ SunlitDrupal · Commerce CoreEPSS 0.14%via CVEORG
CVE-2026-118543None
6d ago

Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

▾ SunlitDrupal · Commerce CoreEPSS 0.13%via CVEORG
CVE-2026-118556None
6d ago

Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261

Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

▾ SunlitDrupal · Commerce ShippingEPSS 0.15%via CVEORG
CVE-2026-118555None
6d ago

Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260

Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.

▾ SunlitDrupal · Commerce LicenseEPSS 0.15%via CVEORG
CVE-2026-118560None
6d ago

Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

▾ SunlitDrupal · Commerce StripeEPSS 0.16%via CVEORG
CVE-2026-118559None
6d ago

Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264

Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.

▾ SunlitDrupal · Commerce StripeEPSS 0.10%via CVEORG
CVE-2026-118557None
6d ago

Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262

Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

▾ SunlitDrupal · Commerce ShippingEPSS 0.14%via CVEORG
CVE-2026-118558None
6d ago

Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

▾ SunlitDrupal · Commerce StripeEPSS 0.10%via CVEORG
CVE-2026-118545None
6d ago

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0…

▾ SunlitDrupal · AI (Artificial Intelligence)EPSS 0.17%via CVEORG
CVE-2026-118550None
6d ago

AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versi…

▾ SunlitDrupal · AI (Artificial Intelligence)EPSS 0.19%via CVEORG
CVE-2026-118549None
6d ago

AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0…

▾ SunlitDrupal · AI (Artificial Intelligence)EPSS 0.17%via CVEORG
CVE-2026-118561None
6d ago

Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

▾ SunlitDrupal · Single Content SyncEPSS 0.15%via CVEORG
CVE-2026-118548None
6d ago

AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268

Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

▾ SunlitDrupal · AI (Artificial Intelligence)EPSS 0.15%via CVEORG
CVE-2026-118546None
6d ago

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0…

▾ SunlitDrupal · AI (Artificial Intelligence)EPSS 0.17%via CVEORG
CVE-2026-118552None
6d ago

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0…

▾ SunlitDrupal · AI (Artificial Intelligence)EPSS 0.17%via CVEORG
CVE-2026-118551None
6d ago

AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271

Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

▾ SunlitDrupal · AI (Artificial Intelligence)EPSS 0.15%via CVEORG
CVE-2026-118563None
6d ago

CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276

Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*.

▾ SunlitDrupal · CacheFlushEPSS 0.15%via CVEORG
CVE-2026-118553None
6d ago

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, …

▾ SunlitDrupal · AI (Artificial Intelligence)EPSS 0.17%via CVEORG
CVE-2026-118565None
6d ago

GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278

Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*.

▾ SunlitDrupal · GroupEx PRO ( Daxko ) integrationEPSS 0.15%via CVEORG
Drupal vulnerabilities (CVEs) — page 3 · VulnSea