Drupal has 184 CVEs on record between 2018 and 2026. Disclosure cadence is accelerating: 182 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 178. The median CVSS is 4.8 (medium), with 4 rated critical. 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-79 (45) and CWE-863 (35). Most affected products: Webform (20), SAML SSO - Service Provider (11), AI (Artificial Intelligence) (10).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 4.8
- Publish → KEV
- —(2)
- Last 90 days
- 182 prev 1
Weakness classes
Products
- Webform 20
- SAML SSO - Service Provider 11
- AI (Artificial Intelligence) 10
- Commerce Core 6
- Commerce Stripe 3
- Drupal core 3
Worst active — by depth score
CVE-2018-7602Critical· 9.8A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x100CVE-2026-9082Critical· 9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 1…97CVE-2026-107249Critical· 9.8Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-19254CVE-2026-96355Critical· 9.1Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-17550CVE-2026-110176High· 8.7File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers48
Drupal vulnerabilities
CVEs affecting Drupal, newest first. Open any entry for full detail, references, and exploit status.
184 CVEsRSS
CVE-2026-87946Medium· 4.8SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144
Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87944Medium· 4.8SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142
Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87947Medium· 4.8SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145
Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87945Medium· 5.4SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87943Medium· 6.5SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141
Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87942Medium· 4.6SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.
CVE-2026-84921Medium· 5.3Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133
Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.
CVE-2026-87941Medium· 5.9Patreon - Critical - Unsupported - SA-CONTRIB-2026-139
Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.
CVE-2026-84919Medium· 4.6PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript …
CVE-2026-84918Low· 3.7Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130
Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.
CVE-2026-87940Medium· 5.4Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.
CVE-2026-87939Medium· 4.2Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.
CVE-2026-84920Medium· 5.3Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132
Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.
CVE-2026-87937Medium· 6.5Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to …
CVE-2026-87938Medium· 6.5CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.
CVE-2026-87936Medium· 6.5amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3…
CVE-2026-84916Low· 3.7Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126
Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.
CVE-2026-84924Medium· 5.4Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verif…
CVE-2026-84917Medium· 6.5Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127
Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.
CVE-2026-84914Medium· 5.3Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122
Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.
CVE-2026-81163Medium· 5.4Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.
CVE-2026-16648Low· 3.8Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128
Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.
CVE-2026-84923Medium· 6.5Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verifi…
CVE-2026-84915Medium· 4.6Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.
CVE-2026-84913Medium· 4.6AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121
Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.
CVE-2026-84912Medium· 4.6AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.
CVE-2026-84911Low· 3.1AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, …
CVE-2026-84910Medium· 4.2Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118
Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.
CVE-2026-76782High· 7.3Vulnerability in Drupal Screenshot
Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.
CVE-2026-76757Medium· 5.9Vulnerability in Drupal Gammu SMS Daemon
Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.