Drupal has 184 CVEs on record between 2018 and 2026. Disclosure cadence is accelerating: 182 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 178. The median CVSS is 4.8 (medium), with 4 rated critical. 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-79 (45) and CWE-863 (35). Most affected products: Webform (20), SAML SSO - Service Provider (11), AI (Artificial Intelligence) (10).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 4.8
- Publish → KEV
- —(2)
- Last 90 days
- 182 prev 1
Weakness classes
Products
- Webform 20
- SAML SSO - Service Provider 11
- AI (Artificial Intelligence) 10
- Commerce Core 6
- Commerce Stripe 3
- Drupal core 3
Worst active — by depth score
CVE-2018-7602Critical· 9.8A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x100CVE-2026-9082Critical· 9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 1…97CVE-2026-107249Critical· 9.8Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-19254CVE-2026-96355Critical· 9.1Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-17550CVE-2026-110176High· 8.7File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers48
Drupal vulnerabilities
CVEs affecting Drupal, newest first. Open any entry for full detail, references, and exploit status.
184 CVEsRSS
CVE-2026-96376Medium· 6.4Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177
Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.
CVE-2026-96374Medium· 4.2Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.
CVE-2026-96355Critical· 9.1Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96375Medium· 4.8Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.
CVE-2026-96364Medium· 5.3Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171
Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96356Medium· 5.3Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96366Medium· 5.3Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96365High· 7.5Webform - Less critical - Denial of service - SA-CONTRIB-2026-170
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96357Medium· 4.6Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96373Low· 3.3Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96368Medium· 4.6Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96372Medium· 5.4Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96363Low· 3.1Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96371Medium· 5.4Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96370Medium· 5.4Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164
Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96367Medium· 4.6Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96369Low· 3.1Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6…
CVE-2026-96362Medium· 4.2Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96358Medium· 4.6Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96360Low· 3.5Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96359Medium· 4.6Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-87954Medium· 4.3Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152
Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0.
CVE-2026-96361Medium· 4.6Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-87953Low· 3.3SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151
Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87955Medium· 4.3Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153
Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.
CVE-2026-87952Low· 3.1SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150
Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87951Low· 3.8SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149
Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87950Medium· 5.3SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148
Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87949Low· 3.3SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0…
CVE-2026-87948Low· 3.5SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0…