Drupal

Products

ProductCVEsExploitedLatest
Drupal Core413Oct 30, 2026
Core191Sep 28, 2023
Webform20–Oct 22, 2026
AI (Artificial Intelligence)18–Oct 30, 2026
SAML SSO - Service Provider13–Oct 22, 2026
Open Social8–Jun 26, 2025
Commerce Core7–Oct 30, 2026
Enterprise MFA - TFA for Drupal6–Jun 26, 2025
Drupal Canvas4–Jul 10, 2026
Monster Menus4–Oct 30, 2026
COOKiES Consent Management4–Aug 15, 2025
Two-factor Authentication (TFA)4–Jul 8, 2025
Commerce Stripe3–Oct 30, 2026
Gammu SMS Daemon3–Sep 2, 2026
Disable Login Page3–Sep 2, 2026
One Time Password3–May 21, 2025
Login Disable3–Jul 10, 2026
Tagify3–Jul 10, 2026
Single Content Sync3–Oct 30, 2026
Authenticator Login3–Oct 10, 2025
UI Icons3–Oct 30, 2026
Facets3–Oct 10, 2025
OpenID Connect / OAuth client3–Mar 26, 2026
Klaro Cookie & Consent Management2–Jun 26, 2025
Google Tag2–Mar 31, 2025
Paragraphs2–Jul 10, 2026
Quick Node Block2–Jun 11, 2025
Commerce Shipping2–Oct 30, 2026
Freelinking2–Oct 30, 2026
Obfuscate2–May 19, 2026
Central Authentication System (CAS) Server2–Oct 22, 2026
Acquia DAM2–Oct 29, 2025
Data field2–Oct 30, 2026
FlowDrop2–Jul 10, 2026
Block Attributes2–Oct 30, 2026
Node Access Rebuild Progressive2–Jan 9, 2025
ECA: Event - Condition - Action2–Jul 10, 2026
Access code2–Oct 29, 2025
Stage File Proxy2–Oct 30, 2026
Islandora2–Oct 22, 2026
Media Alias Display2–Oct 30, 2026
Fasttoggle2–Oct 30, 2026
File Entity (fieldable files)2–Jan 9, 2025
Simple Klaro2–Jun 13, 2025
Authenticator Login Plus (2FA)2–Oct 30, 2026
Colorbox2–Jul 10, 2026
Anti-Spam by CleanTalk2–Jul 10, 2026
Webform REST2–Oct 22, 2026
Cloud2–Oct 22, 2026
AI Agents2–Jul 10, 2026
Examples for Developers2–Oct 30, 2026
Paragraphs table2–Jun 26, 2025
POST File2–Jan 9, 2025
Diff2–Sep 2, 2026
Email Verification / SMS Verification / OTP Verification2–Oct 22, 2026
Swiper formatter2–Oct 30, 2026
Unpublished Node Permissions2–Oct 22, 2026
Simple OAuth (OAuth2) & OpenID Connect2–Oct 30, 2026
Drupal2–Jan 28, 2026
Gutenberg2–Oct 30, 2026
File Access Fix (deprecated)2–Mar 26, 2026
Frontend Editing2–Oct 30, 2026
Email TFA2–Nov 18, 2025
Screenshot2–Sep 2, 2026
Advanced Content Feedback (aka admin_feedback)2–Jul 10, 2026
CivicTheme Design System2–Oct 29, 2025
Field Permissions2–Oct 30, 2026
CAPTCHA2–Oct 30, 2026
PhotoSwipe - Responsive JavaScript Modal Image Gallery2–Oct 22, 2026
Restrict route by IP2–Oct 30, 2026
Permissions by Term1–Oct 30, 2026
CSV Field1–Oct 30, 2026
OAuth2 Token Manager1–Oct 30, 2026
Simple Hierarchical Select (shs)1–May 21, 2026
Google Maps: Store Locator1–Apr 16, 2025
Monobank payment API1–Oct 22, 2026
Link1–Mar 31, 2025
Synchronize composer.json With Contrib Modules1–Oct 10, 2025
Internationalization (i18n) - i18n_node submodule1–Mar 26, 2026
AI File to Text1–Oct 30, 2026
Calculation Fields1–Mar 26, 2026
File Download1–Jul 21, 2025
Sportsleague1–Apr 23, 2025
Token Content Access1–Aug 25, 2026
OpenAI Provider1–Jul 10, 2026
External Authentication1–Sep 2, 2026
TinyPNG1–Oct 30, 2026
oEmbed Providers1–May 14, 2025
LDAP / Active Directory Integration1–Sep 2, 2026
Protected Pages1–Oct 10, 2025
Plausible tracking1–Oct 29, 2025
Ignition Error Pages1–Mar 31, 2025
Mail Login1–Jul 21, 2025
Layout Builder Advanced Permissions1–Aug 15, 2025
CKEditor 5 Premium Features1–Jan 28, 2026
Admin Audit Trail1–Jun 11, 2025
Currency1–Oct 29, 2025
AJAX Dashboard1–Mar 26, 2026
Media Bulk Upload1–Oct 30, 2026
Block permissions1–Jan 9, 2025
AI CKEditor1–Oct 22, 2026
baguetteBox.js1–Apr 16, 2025
Commerce Eurobank (Redirect)1–Jun 11, 2025
TFA Basic Plugins1–May 28, 2026
Facebook Pixel1–Jan 14, 2026
Panelizer (obsolete)1–Apr 16, 2025
Commerce Realex / Global Payments1–Jul 10, 2026
SafeDelete1–Oct 22, 2026
S3 File System1–Oct 30, 2026
Email Login OTP1–Aug 25, 2026
Opigno1–Jan 9, 2025
CacheFlush1–Oct 30, 2026
amazee.ai Private AI Provider1–Oct 22, 2026
Migrate queue importer1–Jan 9, 2025
etracker1–Jun 13, 2025
Orphans Media1–Oct 30, 2026
Commerce guest registration1–Jul 10, 2026
Digital Signage Framework1–Sep 2, 2026
Git Utilities for Drupal1–Jan 9, 2025
Acquia Content Hub1–Jan 28, 2026
Matomo Analytics1–Mar 31, 2025
Ágora Transparency Theme1–Oct 30, 2026
Content Entity Clone1–Jan 9, 2025
Link content parser1–Sep 2, 2026
Swift Mailer (abandoned)1–Jan 9, 2025
Project Browser1–Oct 22, 2026
OpenID Connect Client1–Oct 30, 2026
Entity Share1–Jan 28, 2026
Material Icons1–Mar 25, 2026
Field Collection for Drupal 71–Oct 30, 2026
Drupal 8 Google Optimize Hide Page1–Apr 16, 2025
Webform Submissions Delete1–Oct 22, 2026
AI Translate1–Oct 22, 2026
IFrame Remove Filter1–May 14, 2025
Clean RESTful1–Jul 10, 2026
REST & JSON API Authentication for Drupal1–Oct 22, 2026
OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client)1–Jan 9, 2025
CKEditor 4 LTS - WYSIWYG HTML editor1–Jan 9, 2025
Commerce CyberSource1–Sep 2, 2026
EU Cookie Compliance (GDPR Compliance)1–Jun 13, 2025
ABC1–Oct 30, 2026
Linked Field1–Oct 30, 2026
Simple multi step form1–Nov 18, 2025
Date iCal1–May 19, 2026
GLightbox1–Jun 26, 2025
REST Views1–Jan 9, 2025
Raw Formatter [Meta Tag Formatter]1–Jul 10, 2026
ImageAPI Optimize WebP1–Oct 30, 2026
Taxonomy Term Glossary1–Oct 22, 2026
Simple GTM1–Apr 16, 2025
Commerce Alphabank Redirect1–Jun 11, 2025
Drupal File (Field) Paths1–Mar 26, 2026
API Key manager1–Oct 10, 2025
Black Hole1–Oct 30, 2026
Drupal Symfony Mailer Lite1–Jan 9, 2025
View Unpublished1–Oct 30, 2026
Composer1–Jul 10, 2026
Events Log Track1–May 21, 2025
CSS Usage Analyzer1–Oct 22, 2026
Internationalization Single Sign-On1–Aug 25, 2026
Tarte au Citron1–Jan 9, 2025
Group invite1–Feb 4, 2026
Download All Files1–Jan 9, 2025
Advanced Filesystem1–Oct 30, 2026
Login Time Restriction1–Jan 28, 2026
Entity Share Websub1–Sep 2, 2026
CSP log1–Oct 22, 2026
LocalGov Workflows1–Jul 10, 2026
Salesforce Suite1–Jul 10, 2026
Views Share1–Oct 30, 2026
General Data Protection Regulation1–Mar 31, 2025
Rabbit Hole1–Oct 30, 2026
Opigno group manager1–Jan 9, 2025
Bulk Update User Roles1–Oct 30, 2026
SpamSpan filter1–Mar 31, 2025
Dopup1–Oct 30, 2026
Commerce License1–Oct 30, 2026
Bootstrap Site Alert1–Apr 23, 2025
Country1–Oct 30, 2026
WissKI1–Jul 10, 2026
MathJax: LaTeX for Drupal1–Oct 30, 2026
Migrate Tools1–Jan 9, 2025
Lightgallery1–Jun 11, 2025
Real-time SEO for Drupal1–Jul 21, 2025
Automated Logout1–Mar 26, 2026
Term Reference Tree1–May 21, 2026
DocCheck Basic1–Oct 30, 2026
Actstream1–Oct 30, 2026
OAuth2 Client1–Mar 31, 2025
Custom Formatters1–Oct 30, 2026
Drupal Commerce Paybox1–Jan 28, 2026
Material Admin1–Mar 31, 2025
Link field display mode formatter1–Mar 31, 2025
Cache Utility1–Mar 31, 2025
Block AJAX1–Oct 30, 2026
Quick Edit1–Mar 25, 2026
Flag attendance field1–Jul 10, 2026
Jsonapi Role Access1–Oct 22, 2026
Inline Entity Form Dialog1–Oct 30, 2026
Signature pad widget1–Oct 30, 2026

Exploited and recent CVEs

  • CVE-2026-9082 Critical 9.8 Exploited Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 89.4%
  • CVE-2020-13671 High 8.8 Exploited Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP fo 36.2%
  • CVE-2019-6340 High 8.1 Exploited Drupal core - Highly critical - Remote Code Execution 92.0%
  • CVE-2018-7602 High 8.1 Exploited Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 99.2%
  • CVE-2026-110176 High 8.7 File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers 0.2%
  • CVE-2026-77152 Medium 5.3 Field Collection for Drupal 7 access bypass via missing parent entity access check 0.2%
  • CVE-2026-107249 Critical 9.8 Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192 0.4%
  • CVE-2026-107250 Medium 5.9 ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193 0.2%
  • CVE-2026-107251 Medium 6.5 Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194 0.2%
  • CVE-2026-107252 Medium 5.4 MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195 0.1%
  • CVE-2026-107253 Medium 5.9 Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196 0.2%
  • CVE-2026-107254 Medium 4.8 Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197 0.2%
  • CVE-2026-107257 Medium 6.5 Actstream - Critical - Access bypass - SA-CONTRIB-2026-198 0.2%
  • CVE-2026-107258 Medium 5.4 Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199 0.2%
  • CVE-2026-107259 Medium 5.4 Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200 0.2%
  • CVE-2026-107261 Medium 4.2 Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201 0.2%
  • CVE-2026-107263 Medium 5.4 Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202 0.2%
  • CVE-2026-107264 Medium 5.4 Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203 0.2%
  • CVE-2026-107265 Medium 5.4 Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204 0.2%
  • CVE-2026-107266 Unrated Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205 0.1%
  • CVE-2026-96389 Medium 6.5 Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206 0.2%
  • CVE-2026-107268 Medium 4.3 Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207 0.3%
  • CVE-2026-107267 Medium 5.3 DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208 0.2%
  • CVE-2026-107306 Low 3.8 Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209 0.2%
  • CVE-2026-107307 Medium 4.3 SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210 0.2%
  • CVE-2026-107308 Low 3.1 Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211 0.1%
  • CVE-2026-107309 Low 3.7 Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212 0.2%
  • CVE-2026-107310 Medium 4.3 Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213 0.2%
  • CVE-2026-107311 Low 3.7 Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214 0.2%
  • CVE-2026-107312 Medium 4.3 Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215 0.3%