CVE-2026-46634 vulnerabilities

Vulnerabilities for packages: drupal...

CVE-2026-46628 vulnerabilities

Vulnerabilities for packages: drupal...

GHSA-7P85-W9PX-JPJP vulnerabilities

Vulnerabilities for packages: drupal...

GHSA-7FXW-R6JV-74C8 vulnerabilities

Vulnerabilities for packages: drupal...

CVE-2026-46640 vulnerabilities

Vulnerabilities for packages: drupal...

GHSA-24X9-R6Q4-Q93W vulnerabilities

Vulnerabilities for packages: drupal...

CVE-2026-46635 vulnerabilities

Vulnerabilities for packages: drupal...

GHSA-4J38-F5CW-54H7 vulnerabilities

Vulnerabilities for packages: drupal...

GHSA-45VW-WH46-2VX8 vulnerabilities

Vulnerabilities for packages: drupal...

CVE-2026-46633 vulnerabilities

Vulnerabilities for packages: drupal...

Exploit for CVE-2026-9082

CVE-2026-9082 — Drupal PostgreSQL SQL Injection Mass Scanner & E...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-9082link is external Drupal Core SQL Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses...

EUVD-2026-31377

In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A token display templates: When the Token module is enabled and token display templates are configured, attacker-controlled token output e.g., term description is rendered...

EUVD-2026-31381

Simple Hierarchical Select SHS for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths include field formatter output shsfieldformatterview and term-tree child-term data generation shstermgetchildren. Malicious taxonomy term...

VulnCheck KEV: CVE-2026-9082

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0...

Drupal Core SQL Injection Vulnerability

Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API...

The vulnerability of the application software interface of the Drupal CMS system allows a hacker to enhance their privileges and execute arbitrary code.

The vulnerability of the application software interface of the Drupal CMS system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute arbitrary code...

CVE-2026-4929

Simple Hierarchical Select SHS for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths include field formatter output shsfieldformatterview and term-tree child-term data generation shstermgetchildren. Malicious taxonomy term...

CVE-2026-4093

In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A token display templates: When the Token module is enabled and token display templates are configured, attacker-controlled token output e.g., term description is rendered...

CVE-2026-4093 Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels)

In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A token display templates: When the Token module is enabled and token display templates are configured, attacker-controlled token output e.g., term description is rendered...