Drupal — security advisories

50 advisories6 exploitedlatest 2026-08-24⚡ RSS feed

Tracked Drupal products:

Drupal Core Core Drupal Extensions Location Selector Drupal Modules Drupal Extensions AlternativeCommerce AI Agents Internationalization Single Sign-On Drupal Module

⚡ Watch Drupal

Get an email when a new Drupal advisory drops — max one per day, one-click unsubscribe.

[UPDATE] [high] Drupal: Vulnerability enables execution of arbitrary program code with the rights of the service

highcert-bund2026-08-24

[NEW] [UNPATCHED] [high] Drupal Module: Multiple vulnerabilities enable unspecified attack

highCVE-2026-76755 CVE-2026-76756 CVE-2026-76757 CVE-2026-76758cert-bund2026-08-20

[NEW] [medium] Drupal Module: Multiple vulnerabilities

mediumCVE-2026-73474 CVE-2026-73475 CVE-2026-73476 CVE-2026-73477cert-bund2026-08-13

[NEW] [medium] Drupal Module: Multiple Vulnerabilities

mediumCVE-2026-18985 CVE-2026-18986cert-bund2026-08-06

[NEW] [medium] Drupal (Token Content Access, Disable Login Page and Powerful Surveys): Multiple vulnerabilities

mediumCVE-2026-18259 CVE-2026-18260 CVE-2026-18261cert-bund2026-07-30

[NEW] [medium] Drupal Modules: Multiple Vulnerabilities

mediumCVE-2026-16638 CVE-2026-16639 CVE-2026-16640 CVE-2026-16644cert-bund2026-07-23

[NEW] [high] Drupal Modules: Multiple vulnerabilities

highCVE-2026-15079 CVE-2026-15080 CVE-2026-15081 CVE-2026-15082cert-bund2026-07-23

Drupal security advisory (AV26-738)

criticalcccs2026-07-22

Drupal plugin "AI Agents" vulnerable to incorrect authorization

unknownCVE-2026-13236jvn2026-07-21

[UPDATE] [medium] Drupal Extensions: Multiple vulnerabilities

mediumCVE-2026-10768 CVE-2026-10769 CVE-2026-10770 CVE-2026-49977cert-bund2026-07-20

[NEW] [medium] Drupal Core: Multiple vulnerabilities

mediumCVE-2026-15916 CVE-2026-15917 CVE-2026-55805cert-bund2026-07-16

Multiple vulnerabilities in Drupal (July 16, 2026)

unknownCVE-2026-15916 CVE-2026-55805 CVE-2026-15917cert-fr-avis2026-07-16

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

criticalCVE-2026-55805drupal2026-07-15

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

criticalCVE-2026-15917drupal2026-07-15

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

criticalCVE-2026-15916drupal2026-07-15

[UPDATE] [medium] Drupal: Multiple vulnerabilities

mediumCVE-2026-13231 CVE-2026-13232 CVE-2026-13233 CVE-2026-13234cert-bund2026-07-13

[UPDATE] [critical] Drupal Core: Multiple vulnerabilities

criticalCVE-2026-55803 CVE-2026-55804 CVE-2026-55806 CVE-2026-55807cert-bund2026-07-13

[UPDATE] [high] Drupal Modules: Multiple vulnerabilities allow data manipulation

highCVE-2026-12535 CVE-2026-55809 CVE-2026-55810cert-bund2026-07-13

[UPDATE] [medium] Drupal: Multiple vulnerabilities

mediumCVE-2026-11908 CVE-2026-11909 CVE-2026-11913 CVE-2026-11914cert-bund2026-07-13

[UPDATE] [high] Drupal AlternativeCommerce (Basket): Vulnerability allows code execution

highCVE-2026-9726cert-bund2026-07-13

[NEW] [medium] Drupal Extensions: Multiple vulnerabilities

mediumCVE-2026-58587 CVE-2026-58588 CVE-2026-58589 CVE-2026-58590cert-bund2026-07-13

Drupal security advisory (AV26-676)

criticalcccs2026-07-08

Drupal security advisory (AV26-631)

criticalcccs2026-06-25

Drupal Multiple Vulnerabilities

unknownCVE-2026-55803 CVE-2026-55804 CVE-2026-55806 CVE-2026-55807hkcert2026-06-23

Drupal security advisory (AV26-615)

criticalcccs2026-06-18

Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

criticalCVE-2026-55808drupal2026-06-17

Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

criticalCVE-2026-55807drupal2026-06-17

Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

criticalCVE-2026-55806drupal2026-06-17

Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

criticalCVE-2026-55804drupal2026-06-17

Drupal core - Critical - PHP object injection - SA-CORE-2026-005

criticalCVE-2026-55803drupal2026-06-17

CVE-2026-9082: Drupal Core SQL Injection Vulnerability

criticalexploitedCVE-2026-9082cisa-kev2026-05-22

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

criticalexploitedCVE-2026-9082drupal2026-05-20

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003

criticalCVE-2026-6367drupal2026-04-15

Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

criticalCVE-2026-6366drupal2026-04-15

Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001

criticalCVE-2026-6365drupal2026-04-15

Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

criticalCVE-2025-13083drupal2025-11-12

Drupal core - Moderately critical - Defacement - SA-CORE-2025-007

criticalCVE-2025-13082drupal2025-11-12

Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006

criticalCVE-2025-13081drupal2025-11-12

Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005

criticalCVE-2025-13080drupal2025-11-12

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

criticalCVE-2025-31675drupal2025-03-19

Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

criticalCVE-2025-31674drupal2025-02-19

Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

criticalCVE-2025-31673drupal2025-02-19

Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

criticalCVE-2025-3057drupal2025-02-19

Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008

criticalCVE-2024-55638drupal2024-11-20

Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007

criticalCVE-2024-55637drupal2024-11-20

Drupal core - Less critical - Gadget chain - SA-CORE-2024-006

criticalCVE-2024-55636drupal2024-11-20

CVE-2018-7602: Drupal Core Remote Code Execution Vulnerability

criticalexploitedCVE-2018-7602cisa-kev2022-04-13

CVE-2019-6340: Drupal Core Remote Code Execution Vulnerability

criticalexploitedCVE-2019-6340cisa-kev2022-03-25

CVE-2020-13671: Drupal core Un-restricted Upload of File

criticalexploitedCVE-2020-13671cisa-kev2022-01-18

CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability

criticalexploitedCVE-2018-7600cisa-kev2021-11-03