Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

942 records

Vendor: Drupal Clear all filters
TI-2026-83457 CVE-2026-110176 · GHSA-wc74-vwp5-gqfv

Access bypass in Drupal 7 File Force Download via download parameter

Priority MEDIUM 43

The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00249 Published 2026-10-31 Fixed in 7.1.3 CWE-863
TI-2026-83455 CVE-2026-77152 · GHSA-f2vh-vxfq-92pj

Field Collection for Drupal 7 lets users bypass parent entity access

Priority LOW 23

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00228 Published 2026-10-30 No fix listed CWE-285
TI-2026-82825 CVE-2026-107249 · GHSA-6pcx-w9cj-f597

PHP object injection in Drupal Block AJAX

Priority MEDIUM 49

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00394 Published 2026-10-30 Fixed in 3.0.2 CWE-915
TI-2026-82828 CVE-2026-107252 · GHSA-cxwv-8h42-979j

Cross-site scripting in Drupal MathJax: LaTeX for Drupal

Priority LOW 23

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00149 Published 2026-10-30 Fixed in 4.1.2 CWE-79
TI-2026-82830 CVE-2026-107254 · GHSA-p825-6r72-qfr4

Authentication bypass in Drupal Authenticator Login Plus (2FA)

Priority LOW 21

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00221 Published 2026-10-30 Fixed in 1.0.1 CWE-288
TI-2026-82841 CVE-2026-107265 · GHSA-633j-xmq5-c7r4

Stored cross-site scripting in Drupal Leaflet module

Priority LOW 22

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS.

CVSS — EPSS 0.0018 Published 2026-10-30 Fixed in 10.4.13 CWE-79
TI-2026-82845 CVE-2026-107306 · GHSA-34jp-3hpv-473h

Stored cross-site scripting in Drupal Menu Link Attributes

Priority LOW 17

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS.

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00193 Published 2026-10-30 Fixed in 1.8.0 CWE-79
TI-2026-82847 CVE-2026-107308 · GHSA-8x23-vvq4-9478

Cross-site scripting in Drupal Country module

Priority LOW 14

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS).

CVSS 3.1LOW 3.1 Network High privileges User interaction EPSS 0.0015 Published 2026-10-30 Fixed in 2.1.3, 2.2.1 CWE-79
TI-2026-82849 CVE-2026-107310 · GHSA-p6fh-9484-jwr6

Server-side request forgery in Drupal Freelinking

Priority LOW 19

Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00197 Published 2026-10-30 Fixed in 4.0.3 CWE-918
Load more