# Drupal vulnerabilities Source: https://junglewise.ai/threats/vendors/drupal Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/drupal.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 309 vulnerabilities in Drupal: 23 in the last 7 days and 243 in the last 90 days, 10 of them critical and 6 exploited in the wild. The most recent, CVE-2026-126760, was published on 11 November 2026. 194 vulnerabilities in the last four weeks, up 19300% on the four before (1). 11 technologies have a page of their own. ## Counts - Last 7 days: 23 - Last 30 days: 217 - Last 90 days: 243 - All time: 309 (10 critical, 6 exploited in the wild) ## About Drupal An open-source content management framework written in PHP. ## Latest Drupal vulnerabilities - [CVE-2026-126760: Drupal Data Field cross-site scripting in autocomplete](https://junglewise.ai/threats/cve-2026-126760-drupal-contrib-2026-339-this-module-provides-a-field-type-for) (info, published 11 Nov 2026) - [CVE-2026-126747: Drupal File Resumable Upload improper authorization in upload forms](https://junglewise.ai/threats/cve-2026-126747-drupal-contrib-2026-338-this-module-adds-large-file-multiple) (info, published 11 Nov 2026) - [CVE-2026-126746: Drupal S3 File System CORS Upload improper authorization](https://junglewise.ai/threats/cve-2026-126746-drupal-contrib-2026-337-the-s3-file-system-cors-upload-module) (info, published 11 Nov 2026) - [CVE-2026-126745: Drupal Real Name module Twig injection](https://junglewise.ai/threats/cve-2026-126745-drupal-contrib-2026-336-this-module-enables-you-to-display-users) (info, published 11 Nov 2026) - [CVE-2026-126744: Layout Builder iFrame Modal cross-site scripting in Ajax command](https://junglewise.ai/threats/cve-2026-126744-drupal-contrib-2026-335-this-module-renders-layout-builder-forms) (info, published 11 Nov 2026) - [Drupal COOKiES Consent Management cross-site scripting in Video submodule](https://junglewise.ai/threats/drupal-contrib-2026-334-this-module-enables-you-to-manage-user-consent-be1ec0da) (info, published 11 Nov 2026) - [CVE-2026-126742: Drupal Commerce sermepa payment verification bypass](https://junglewise.ai/threats/cve-2026-126742-drupal-contrib-2026-333-the-commerce-sermpea-module-provides) (info, published 11 Nov 2026) - [CVE-2026-126741: Drupal Smart Trim cross-site scripting in Twig filter](https://junglewise.ai/threats/cve-2026-126741-drupal-contrib-2026-332-this-module-implements-a-field-formatter) (info, published 11 Nov 2026) - [CVE-2026-126740: Drupal Download Count access bypass in permission checks](https://junglewise.ai/threats/cve-2026-126740-drupal-contrib-2026-331-this-module-tracks-file-downloads-for) (info, published 11 Nov 2026) - [CVE-2026-126739: Drupal Page Manager CSRF in UI submodule](https://junglewise.ai/threats/cve-2026-126739-drupal-contrib-2026-330-this-module-enables-you-to-create-custom) (info, published 11 Nov 2026) - [CVE-2026-126738: Mollie for Drupal secret token information disclosure](https://junglewise.ai/threats/cve-2026-126738-drupal-contrib-2026-329-this-module-enables-you-to-accept-online) (info, published 11 Nov 2026) - [CVE-2026-126736: Entity Print sensitive information disclosure to third-party servers](https://junglewise.ai/threats/cve-2026-126736-drupal-contrib-2026-327-this-module-enables-you-to-print-and) (info, published 11 Nov 2026) - [CVE-2026-126735: Drupal Campaign Monitor module cross-site request forgery](https://junglewise.ai/threats/cve-2026-126735-drupal-contrib-2026-326-this-module-integrates-the-campaign) (info, published 11 Nov 2026) - [CVE-2026-126734: Paragraphs entity embed cross-site scripting in autocomplete filter](https://junglewise.ai/threats/cve-2026-126734-drupal-contrib-2026-325-this-module-enables-you-to-provide-a-way) (info, published 11 Nov 2026) - [CVE-2026-126733: Drupal Commerce License insufficient validation in order items](https://junglewise.ai/threats/cve-2026-126733-drupal-contrib-2026-324-this-module-enables-you-to-sell-licenses) (info, published 11 Nov 2026) - [CVE-2026-126732: Drupal Commerce License access bypass in license validation](https://junglewise.ai/threats/cve-2026-126732-drupal-contrib-2026-323-this-module-enables-you-to-sell-licenses) (info, published 11 Nov 2026) - [CVE-2026-126731: Drupal Authenticator Login Plus authentication bypass in 2FA](https://junglewise.ai/threats/cve-2026-126731-drupal-contrib-2026-322-this-module-enables-you-to-require-a) (info, published 11 Nov 2026) - [CVE-2026-126730: Drupal Authenticator Login Plus authentication bypass in 2FA](https://junglewise.ai/threats/cve-2026-126730-drupal-contrib-2026-321-this-module-enables-you-to-require-a) (info, published 11 Nov 2026) - [CVE-2026-126729: Drupal Auth Login Plus two-factor authentication bypass](https://junglewise.ai/threats/cve-2026-126729-drupal-contrib-2026-320-this-module-enables-you-to-require-a) (info, published 11 Nov 2026) - [CVE-2026-126728: Drupal Texts module cross-site request forgery in translation restore](https://junglewise.ai/threats/cve-2026-126728-drupal-contrib-2026-319-the-texts-module-provides-key-based) (info, published 11 Nov 2026) - [CVE-2026-126727: Drupal Texts module cross-site scripting via translation filtering](https://junglewise.ai/threats/cve-2026-126727-drupal-contrib-2026-318-the-texts-module-provides-key-based) (info, published 11 Nov 2026) - [CVE-2026-126726: Drupal Paragraphs Edit improper authorization in edit and delete routes](https://junglewise.ai/threats/cve-2026-126726-drupal-contrib-2026-317-paragraphs-edit-adds-contextual-edit) (info, published 11 Nov 2026) - [CVE-2026-126725: Drupal GraphQL Core Schema improper authorization in password change](https://junglewise.ai/threats/cve-2026-126725-drupal-contrib-2026-316-this-module-provides-a-configurable) (info, published 11 Nov 2026) - [CVE-2026-122079: Drupal htmLawed module cross-site scripting in attribute filtering](https://junglewise.ai/threats/cve-2026-122079-drupal-contrib-2026-315-the-htmlawed-module-enables-use-of-the) (info, published 4 Nov 2026) - [CVE-2026-122080: Drupal htmLawed module cross-site scripting via malformed UTF-8](https://junglewise.ai/threats/cve-2026-122080-drupal-contrib-2026-314-the-htmlawed-module-enables-use-of-the) (info, published 4 Nov 2026) ## Most severe Drupal vulnerabilities - [CVE-2026-9082: Drupal Drupal core SQL injection in database abstraction API](https://junglewise.ai/threats/cve-2026-9082-drupal-drupal-core-sql-injection-in-database-abstraction-api) (critical, exploited in the wild, CVSS 9.8, published 20 May 2026) - [CVE-2018-7602: Drupal Core Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2018-7602-drupal-core-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 23 Apr 2024) - [CVE-2020-36193: Directory Traversal in Archive_Tar](https://junglewise.ai/threats/cve-2020-36193-pear-archive-tar-improper-link-resolution-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 22 Apr 2021) - [CVE-2020-13671: Drupal core Unrestricted Upload of File with Dangerous Type](https://junglewise.ai/threats/cve-2020-13671-drupal-core-un-restricted-upload-of-file) (critical, exploited in the wild, CVSS 3.1, published 12 Oct 2021) - [CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2018-7600-drupal-core-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3, published 14 May 2022) - [CVE-2019-6340: Drupal Core Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2019-6340-drupal-core-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3, published 13 May 2022) - [CVE-2026-16639: Drupal Internationalization Single Sign-On authentication bypass in token validation](https://junglewise.ai/threats/cve-2026-16639-drupal-internationalization-single-sign-on-authentication-bypass) (critical, CVSS 9.8, published 25 Aug 2026) - [CVE-2026-16641: Drupal Commerce Elavon payment module unsupported due to unpatched security vulnerability](https://junglewise.ai/threats/cve-2026-16641-drupal-commerce-elavon-payment-module-unsupported-due-to) (critical, CVSS 9.8, published 25 Aug 2026) - [CVE-2026-16644: Drupal Webform REST access bypass in permission checks](https://junglewise.ai/threats/cve-2026-16644-drupal-webform-rest-access-bypass-in-permission-checks) (critical, CVSS 9.1, published 25 Aug 2026) - [CVE-2026-16645: Drupal PhotoSwipe authorization bypass in image gallery display](https://junglewise.ai/threats/cve-2026-16645-drupal-photoswipe-authorization-bypass-in-image-gallery-display) (critical, CVSS 9.1, published 25 Aug 2026) ## Vulnerabilities per week 194 vulnerabilities in the last four weeks, up 19300% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 15 | 4 | 0 | | 31 Aug 2026 | 10 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 65 | 0 | 0 | | 26 Oct 2026 | 106 | 0 | 0 | | 2 Nov 2026 | 23 | 0 | 0 | | 9 Nov 2026 | 23 | 0 | 0 | ## Drupal technologies - [Drupal Webform](https://junglewise.ai/threats/technologies/webform): 20 vulnerabilities - [Drupal Core](https://junglewise.ai/threats/technologies/drupal-core): 17 vulnerabilities - [Drupal](https://junglewise.ai/threats/technologies/drupal): 14 vulnerabilities - [Drupal Ajenti Core](https://junglewise.ai/threats/technologies/core): 11 vulnerabilities - [Drupal AI](https://junglewise.ai/threats/technologies/drupal-ai-1): 10 vulnerabilities - [Drupal Commerce Core](https://junglewise.ai/threats/technologies/commerce-core): 4 vulnerabilities - [Drupal Commerce Stripe](https://junglewise.ai/threats/technologies/commerce-stripe): 4 vulnerabilities - [Drupal Authenticator Login Plus](https://junglewise.ai/threats/technologies/authenticator-login-plus): 3 vulnerabilities - [Drupal Commerce License](https://junglewise.ai/threats/technologies/commerce-license): 3 vulnerabilities - [Drupal Commerce](https://junglewise.ai/threats/technologies/drupal-commerce-1): 3 vulnerabilities - [Drupal Gammu SMS Daemon](https://junglewise.ai/threats/technologies/gammu-sms-daemon): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Drupal vulnerabilities", https://junglewise.ai/threats/vendors/drupal, 13 November 2026.