https://vulnogram.org/ Most recent CVEs assigned by Drupal.org (drupal). https://vulnogram.org/seaview/icons/drupal.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-16647 https://vulnogram.org/CVE-2026-16647 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4. Medium Wed, 02 Sep 2026 12:55:30 GMT https://vulnogram.org/CVE-2026-18986 https://vulnogram.org/CVE-2026-18986 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0. Medium Wed, 02 Sep 2026 12:45:08 GMT https://vulnogram.org/CVE-2026-73475 https://vulnogram.org/CVE-2026-73475 Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3. Critical Network Exploitable Wed, 02 Sep 2026 12:32:41 GMT https://vulnogram.org/CVE-2026-73478 https://vulnogram.org/CVE-2026-73478 Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1. Medium Network Exploitable Wed, 02 Sep 2026 12:32:40 GMT https://vulnogram.org/CVE-2026-73474 https://vulnogram.org/CVE-2026-73474 Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2. Medium Network Exploitable Wed, 02 Sep 2026 12:32:39 GMT https://vulnogram.org/CVE-2026-73476 https://vulnogram.org/CVE-2026-73476 Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13. Medium Wed, 02 Sep 2026 12:32:38 GMT https://vulnogram.org/CVE-2026-73477 https://vulnogram.org/CVE-2026-73477 Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1. Medium Network Exploitable Wed, 02 Sep 2026 12:32:30 GMT https://vulnogram.org/CVE-2026-76757 https://vulnogram.org/CVE-2026-76757 Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*. Medium Wed, 02 Sep 2026 12:32:29 GMT https://vulnogram.org/CVE-2026-76756 https://vulnogram.org/CVE-2026-76756 Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*. Medium Wed, 02 Sep 2026 12:32:28 GMT https://vulnogram.org/CVE-2026-76755 https://vulnogram.org/CVE-2026-76755 Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*. Medium Wed, 02 Sep 2026 12:32:27 GMT https://vulnogram.org/CVE-2026-76758 https://vulnogram.org/CVE-2026-76758 Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*. Medium Wed, 02 Sep 2026 12:32:26 GMT https://vulnogram.org/CVE-2026-76782 https://vulnogram.org/CVE-2026-76782 Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. High Wed, 02 Sep 2026 12:32:17 GMT https://vulnogram.org/CVE-2026-76759 https://vulnogram.org/CVE-2026-76759 Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. High Wed, 02 Sep 2026 12:32:16 GMT https://vulnogram.org/CVE-2026-81167 https://vulnogram.org/CVE-2026-81167 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25. Medium Wed, 02 Sep 2026 12:32:15 GMT https://vulnogram.org/CVE-2026-81165 https://vulnogram.org/CVE-2026-81165 Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18. Medium Network Exploitable Wed, 02 Sep 2026 12:32:14 GMT https://vulnogram.org/CVE-2026-81168 https://vulnogram.org/CVE-2026-81168 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2. Low Network Exploitable Wed, 02 Sep 2026 12:32:13 GMT https://vulnogram.org/CVE-2026-81159 https://vulnogram.org/CVE-2026-81159 Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0. Low Network Exploitable Wed, 02 Sep 2026 12:32:12 GMT https://vulnogram.org/CVE-2026-81161 https://vulnogram.org/CVE-2026-81161 Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0. Low Wed, 02 Sep 2026 12:32:03 GMT https://vulnogram.org/CVE-2026-81269 https://vulnogram.org/CVE-2026-81269 Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13. Medium Network Exploitable Wed, 02 Sep 2026 12:32:02 GMT https://vulnogram.org/CVE-2026-81166 https://vulnogram.org/CVE-2026-81166 Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1. Medium Network Exploitable Wed, 02 Sep 2026 12:32:01 GMT https://vulnogram.org/CVE-2026-81162 https://vulnogram.org/CVE-2026-81162 Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from… Medium Network Exploitable Wed, 02 Sep 2026 12:31:58 GMT https://vulnogram.org/CVE-2026-81158 https://vulnogram.org/CVE-2026-81158 Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0. Medium Network Exploitable Wed, 02 Sep 2026 12:31:49 GMT https://vulnogram.org/CVE-2026-81164 https://vulnogram.org/CVE-2026-81164 Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5. Medium Wed, 02 Sep 2026 12:31:48 GMT https://vulnogram.org/CVE-2026-81205 https://vulnogram.org/CVE-2026-81205 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2… Medium Network Exploitable Wed, 02 Sep 2026 12:31:42 GMT https://vulnogram.org/CVE-2026-81201 https://vulnogram.org/CVE-2026-81201 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3. Medium Network Exploitable Wed, 02 Sep 2026 12:31:38 GMT https://vulnogram.org/CVE-2026-81160 https://vulnogram.org/CVE-2026-81160 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0. Medium Network Exploitable Wed, 02 Sep 2026 12:31:32 GMT https://vulnogram.org/CVE-2026-15916 https://vulnogram.org/CVE-2026-15916 Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0… Medium Network Exploitable Tue, 25 Aug 2026 22:22:27 GMT https://vulnogram.org/CVE-2026-15917 https://vulnogram.org/CVE-2026-15917 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0… Medium Network Exploitable Tue, 25 Aug 2026 22:22:23 GMT https://vulnogram.org/CVE-2026-55805 https://vulnogram.org/CVE-2026-55805 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4,… Medium Tue, 25 Aug 2026 22:22:20 GMT https://vulnogram.org/CVE-2026-16638 https://vulnogram.org/CVE-2026-16638 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8. Medium Network Exploitable Tue, 25 Aug 2026 22:22:17 GMT https://vulnogram.org/CVE-2026-16639 https://vulnogram.org/CVE-2026-16639 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0. Critical Network Exploitable Tue, 25 Aug 2026 22:22:12 GMT https://vulnogram.org/CVE-2026-16640 https://vulnogram.org/CVE-2026-16640 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0. Medium Network Exploitable Tue, 25 Aug 2026 22:22:09 GMT https://vulnogram.org/CVE-2026-16646 https://vulnogram.org/CVE-2026-16646 Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*. Medium Tue, 25 Aug 2026 22:22:05 GMT https://vulnogram.org/CVE-2026-16641 https://vulnogram.org/CVE-2026-16641 Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*. Critical Network Exploitable Tue, 25 Aug 2026 22:22:02 GMT https://vulnogram.org/CVE-2026-16642 https://vulnogram.org/CVE-2026-16642 Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*. Medium Tue, 25 Aug 2026 22:21:59 GMT https://vulnogram.org/CVE-2026-16643 https://vulnogram.org/CVE-2026-16643 Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*. Medium Tue, 25 Aug 2026 22:21:55 GMT https://vulnogram.org/CVE-2026-16644 https://vulnogram.org/CVE-2026-16644 Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0. Critical Network Exploitable Tue, 25 Aug 2026 22:21:51 GMT https://vulnogram.org/CVE-2026-16645 https://vulnogram.org/CVE-2026-16645 Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0. Critical Network Exploitable Tue, 25 Aug 2026 22:21:47 GMT https://vulnogram.org/CVE-2026-15088 https://vulnogram.org/CVE-2026-15088 Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*. Medium Tue, 25 Aug 2026 22:21:43 GMT https://vulnogram.org/CVE-2026-18259 https://vulnogram.org/CVE-2026-18259 Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2. High Network Exploitable Tue, 25 Aug 2026 22:21:39 GMT https://vulnogram.org/CVE-2026-18260 https://vulnogram.org/CVE-2026-18260 Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4. Medium Tue, 25 Aug 2026 22:21:34 GMT https://vulnogram.org/CVE-2026-18261 https://vulnogram.org/CVE-2026-18261 Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*. Medium Tue, 25 Aug 2026 22:21:28 GMT https://vulnogram.org/CVE-2026-18985 https://vulnogram.org/CVE-2026-18985 Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1. High Tue, 25 Aug 2026 22:19:31 GMT https://vulnogram.org/CVE-2026-11913 https://vulnogram.org/CVE-2026-11913 vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*. Critical Network Exploitable Fri, 10 Jul 2026 22:00:08 GMT https://vulnogram.org/CVE-2026-11914 https://vulnogram.org/CVE-2026-11914 vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*. Medium Fri, 10 Jul 2026 21:59:28 GMT https://vulnogram.org/CVE-2026-11915 https://vulnogram.org/CVE-2026-11915 vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*. Medium Fri, 10 Jul 2026 21:58:18 GMT https://vulnogram.org/CVE-2026-15087 https://vulnogram.org/CVE-2026-15087 vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*. Medium Fri, 10 Jul 2026 21:57:28 GMT https://vulnogram.org/CVE-2026-15086 https://vulnogram.org/CVE-2026-15086 vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*. Medium Fri, 10 Jul 2026 21:57:19 GMT https://vulnogram.org/CVE-2026-15089 https://vulnogram.org/CVE-2026-15089 Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*. Critical Network Exploitable Fri, 10 Jul 2026 21:54:42 GMT https://vulnogram.org/CVE-2026-55808 https://vulnogram.org/CVE-2026-55808 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 1… Medium Fri, 10 Jul 2026 21:46:43 GMT