# Packagist:Https://Packages.drupal.org/8 vulnerabilities Source: https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 755 vulnerabilities in Packagist:Https://Packages.drupal.org/8: 24 in the last 7 days and 252 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126760, was published on 11 November 2026. 193 vulnerabilities in the last four weeks, up from none in the four before. 42 technologies have a page of their own. ## Counts - Last 7 days: 24 - Last 30 days: 217 - Last 90 days: 252 - All time: 755 (5 critical, 0 exploited in the wild) ## About Packagist:Https://Packages.drupal.org/8 Drupal 8 package repository on Packagist. ## Latest Packagist:Https://Packages.drupal.org/8 vulnerabilities - [CVE-2026-126760: Drupal Data Field cross-site scripting in autocomplete](https://junglewise.ai/threats/cve-2026-126760-drupal-contrib-2026-339-this-module-provides-a-field-type-for) (info, published 11 Nov 2026) - [CVE-2026-126747: Drupal File Resumable Upload improper authorization in upload forms](https://junglewise.ai/threats/cve-2026-126747-drupal-contrib-2026-338-this-module-adds-large-file-multiple) (info, published 11 Nov 2026) - [CVE-2026-126746: Drupal S3 File System CORS Upload improper authorization](https://junglewise.ai/threats/cve-2026-126746-drupal-contrib-2026-337-the-s3-file-system-cors-upload-module) (info, published 11 Nov 2026) - [CVE-2026-126745: Drupal Real Name module Twig injection](https://junglewise.ai/threats/cve-2026-126745-drupal-contrib-2026-336-this-module-enables-you-to-display-users) (info, published 11 Nov 2026) - [CVE-2026-126744: Layout Builder iFrame Modal cross-site scripting in Ajax command](https://junglewise.ai/threats/cve-2026-126744-drupal-contrib-2026-335-this-module-renders-layout-builder-forms) (info, published 11 Nov 2026) - [Drupal COOKiES Consent Management cross-site scripting in Video submodule](https://junglewise.ai/threats/drupal-contrib-2026-334-this-module-enables-you-to-manage-user-consent-be1ec0da) (info, published 11 Nov 2026) - [CVE-2026-126742: Drupal Commerce sermepa payment verification bypass](https://junglewise.ai/threats/cve-2026-126742-drupal-contrib-2026-333-the-commerce-sermpea-module-provides) (info, published 11 Nov 2026) - [CVE-2026-126741: Drupal Smart Trim cross-site scripting in Twig filter](https://junglewise.ai/threats/cve-2026-126741-drupal-contrib-2026-332-this-module-implements-a-field-formatter) (info, published 11 Nov 2026) - [CVE-2026-126740: Drupal Download Count access bypass in permission checks](https://junglewise.ai/threats/cve-2026-126740-drupal-contrib-2026-331-this-module-tracks-file-downloads-for) (info, published 11 Nov 2026) - [CVE-2026-126739: Drupal Page Manager CSRF in UI submodule](https://junglewise.ai/threats/cve-2026-126739-drupal-contrib-2026-330-this-module-enables-you-to-create-custom) (info, published 11 Nov 2026) - [CVE-2026-126738: Mollie for Drupal secret token information disclosure](https://junglewise.ai/threats/cve-2026-126738-drupal-contrib-2026-329-this-module-enables-you-to-accept-online) (info, published 11 Nov 2026) - [CVE-2026-126737: Drupal Mollie payment webhook validation bypass](https://junglewise.ai/threats/cve-2026-126737-drupal-contrib-2026-328-this-module-enables-you-to-accept-online) (info, published 11 Nov 2026) - [CVE-2026-126736: Entity Print sensitive information disclosure to third-party servers](https://junglewise.ai/threats/cve-2026-126736-drupal-contrib-2026-327-this-module-enables-you-to-print-and) (info, published 11 Nov 2026) - [CVE-2026-126735: Drupal Campaign Monitor module cross-site request forgery](https://junglewise.ai/threats/cve-2026-126735-drupal-contrib-2026-326-this-module-integrates-the-campaign) (info, published 11 Nov 2026) - [CVE-2026-126734: Paragraphs entity embed cross-site scripting in autocomplete filter](https://junglewise.ai/threats/cve-2026-126734-drupal-contrib-2026-325-this-module-enables-you-to-provide-a-way) (info, published 11 Nov 2026) - [CVE-2026-126733: Drupal Commerce License insufficient validation in order items](https://junglewise.ai/threats/cve-2026-126733-drupal-contrib-2026-324-this-module-enables-you-to-sell-licenses) (info, published 11 Nov 2026) - [CVE-2026-126732: Drupal Commerce License access bypass in license validation](https://junglewise.ai/threats/cve-2026-126732-drupal-contrib-2026-323-this-module-enables-you-to-sell-licenses) (info, published 11 Nov 2026) - [CVE-2026-126731: Drupal Authenticator Login Plus authentication bypass in 2FA](https://junglewise.ai/threats/cve-2026-126731-drupal-contrib-2026-322-this-module-enables-you-to-require-a) (info, published 11 Nov 2026) - [CVE-2026-126730: Drupal Authenticator Login Plus authentication bypass in 2FA](https://junglewise.ai/threats/cve-2026-126730-drupal-contrib-2026-321-this-module-enables-you-to-require-a) (info, published 11 Nov 2026) - [CVE-2026-126729: Drupal Auth Login Plus two-factor authentication bypass](https://junglewise.ai/threats/cve-2026-126729-drupal-contrib-2026-320-this-module-enables-you-to-require-a) (info, published 11 Nov 2026) - [CVE-2026-126728: Drupal Texts module cross-site request forgery in translation restore](https://junglewise.ai/threats/cve-2026-126728-drupal-contrib-2026-319-the-texts-module-provides-key-based) (info, published 11 Nov 2026) - [CVE-2026-126727: Drupal Texts module cross-site scripting via translation filtering](https://junglewise.ai/threats/cve-2026-126727-drupal-contrib-2026-318-the-texts-module-provides-key-based) (info, published 11 Nov 2026) - [CVE-2026-126726: Drupal Paragraphs Edit improper authorization in edit and delete routes](https://junglewise.ai/threats/cve-2026-126726-drupal-contrib-2026-317-paragraphs-edit-adds-contextual-edit) (info, published 11 Nov 2026) - [CVE-2026-126725: Drupal GraphQL Core Schema improper authorization in password change](https://junglewise.ai/threats/cve-2026-126725-drupal-contrib-2026-316-this-module-provides-a-configurable) (info, published 11 Nov 2026) - [CVE-2026-122079: Drupal htmLawed module cross-site scripting in attribute filtering](https://junglewise.ai/threats/cve-2026-122079-drupal-contrib-2026-315-the-htmlawed-module-enables-use-of-the) (info, published 4 Nov 2026) ## Most severe Packagist:Https://Packages.drupal.org/8 vulnerabilities - [CVE-2026-16639: Drupal Internationalization Single Sign-On authentication bypass in token validation](https://junglewise.ai/threats/cve-2026-16639-drupal-internationalization-single-sign-on-authentication-bypass) (critical, CVSS 9.8, published 25 Aug 2026) - [CVE-2026-16641: Drupal Commerce Elavon payment module unsupported due to unpatched security vulnerability](https://junglewise.ai/threats/cve-2026-16641-drupal-commerce-elavon-payment-module-unsupported-due-to) (critical, CVSS 9.8, published 25 Aug 2026) - [CVE-2026-73475: Drupal Commerce PayPal access bypass in Payflow Link](https://junglewise.ai/threats/cve-2026-73475-drupal-commerce-paypal-access-bypass-in-payflow-link) (critical, CVSS 9.1, published 2 Sep 2026) - [CVE-2026-16644: Drupal Webform REST access bypass in permission checks](https://junglewise.ai/threats/cve-2026-16644-drupal-webform-rest-access-bypass-in-permission-checks) (critical, CVSS 9.1, published 25 Aug 2026) - [CVE-2026-16645: Drupal PhotoSwipe authorization bypass in image gallery display](https://junglewise.ai/threats/cve-2026-16645-drupal-photoswipe-authorization-bypass-in-image-gallery-display) (critical, CVSS 9.1, published 25 Aug 2026) - [CVE-2025-8093: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows…](https://junglewise.ai/threats/cve-2025-8093-drupal-contrib-2025-098-this-module-allows-users-to-setup-two) (high, CVSS 8.8, published 10 Oct 2025) - [CVE-2026-18985: Drupal Edit in-place field authorization bypass](https://junglewise.ai/threats/cve-2026-18985-drupal-edit-in-place-field-authorization-bypass) (high, CVSS 8.1, published 25 Aug 2026) - [CVE-2025-12466: Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass](https://junglewise.ai/threats/cve-2025-12466-drupal-contrib-2025-114-this-module-introduces-an-oauth-2-0) (high, CVSS 7.5, published 30 Oct 2025) - [CVE-2025-9954: Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0…](https://junglewise.ai/threats/cve-2025-9954-drupal-contrib-2025-105-this-module-enables-you-to-connect-a) (high, CVSS 7.5, published 30 Oct 2025) - [CVE-2025-12082: Drupal CivicTheme Design System allows Forceful Browsing](https://junglewise.ai/threats/cve-2025-12082-drupal-contrib-2025-112-civictheme-is-a-design-system-and-theme) (high, CVSS 7.5, published 30 Oct 2025) ## Vulnerabilities per week 193 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 12 | 4 | 0 | | 31 Aug 2026 | 23 | 1 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 73 | 0 | 0 | | 26 Oct 2026 | 97 | 0 | 0 | | 2 Nov 2026 | 23 | 0 | 0 | | 9 Nov 2026 | 24 | 0 | 0 | ## Packagist:Https://Packages.drupal.org/8 technologies - [Packagist:Https://Packages.drupal.org/8 Drupal/Webform](https://junglewise.ai/threats/technologies/drupal-webform): 31 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Ai](https://junglewise.ai/threats/technologies/drupal-ai): 18 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Social](https://junglewise.ai/threats/technologies/drupal-social): 16 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Miniorange Saml](https://junglewise.ai/threats/technologies/drupal-miniorange-saml): 15 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Commerce](https://junglewise.ai/threats/technologies/drupal-commerce): 10 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Miniorange 2fa](https://junglewise.ai/threats/technologies/drupal-miniorange-2fa): 7 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Jsonapi](https://junglewise.ai/threats/technologies/drupal-jsonapi): 6 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Permissions By Term](https://junglewise.ai/threats/technologies/drupal-permissions-by-term): 6 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Auth Login Plus](https://junglewise.ai/threats/technologies/drupal-auth-login-plus): 5 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Cookies](https://junglewise.ai/threats/technologies/drupal-cookies): 5 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Facets](https://junglewise.ai/threats/technologies/drupal-facets): 5 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Gutenberg](https://junglewise.ai/threats/technologies/drupal-gutenberg): 5 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Tfa](https://junglewise.ai/threats/technologies/drupal-tfa): 5 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Apigee Edge](https://junglewise.ai/threats/technologies/drupal-apigee-edge): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Cleantalk](https://junglewise.ai/threats/technologies/drupal-cleantalk): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Datafield](https://junglewise.ai/threats/technologies/drupal-datafield): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Graphql](https://junglewise.ai/threats/technologies/drupal-graphql): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Group](https://junglewise.ai/threats/technologies/drupal-group): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Mail Login](https://junglewise.ai/threats/technologies/drupal-mail-login): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Monster Menus](https://junglewise.ai/threats/technologies/drupal-monster-menus): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Openid Connect](https://junglewise.ai/threats/technologies/drupal-openid-connect): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Opigno Learning Path](https://junglewise.ai/threats/technologies/drupal-opigno-learning-path): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Paragraphs](https://junglewise.ai/threats/technologies/drupal-paragraphs): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Simple Oauth](https://junglewise.ai/threats/technologies/drupal-simple-oauth): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Tacjs](https://junglewise.ai/threats/technologies/drupal-tacjs): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Tagify](https://junglewise.ai/threats/technologies/drupal-tagify): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Tb Megamenu](https://junglewise.ai/threats/technologies/drupal-tb-megamenu): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Canvas](https://junglewise.ai/threats/technologies/packagist-https-packages-drupal-org-8-drupal-canvas): 4 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Addtoany](https://junglewise.ai/threats/technologies/drupal-addtoany): 3 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Alogin](https://junglewise.ai/threats/technologies/drupal-alogin): 3 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Commerce License](https://junglewise.ai/threats/technologies/drupal-commerce-license): 3 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Commerce Stripe](https://junglewise.ai/threats/technologies/drupal-commerce-stripe): 3 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Disable Login](https://junglewise.ai/threats/technologies/drupal-disable-login): 3 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Examples](https://junglewise.ai/threats/technologies/drupal-examples): 3 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Islandora](https://junglewise.ai/threats/technologies/drupal-islandora): 3 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Login Disable](https://junglewise.ai/threats/technologies/drupal-login-disable): 3 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Mollie](https://junglewise.ai/threats/technologies/drupal-mollie): 3 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/One Time Password](https://junglewise.ai/threats/technologies/drupal-one-time-password): 3 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Rest Api Authentication](https://junglewise.ai/threats/technologies/drupal-rest-api-authentication): 3 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Single Content Sync](https://junglewise.ai/threats/technologies/drupal-single-content-sync): 3 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Svg Formatter](https://junglewise.ai/threats/technologies/drupal-svg-formatter): 3 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Ui Icons](https://junglewise.ai/threats/technologies/drupal-ui-icons): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Packagist:Https://Packages.drupal.org/8 vulnerabilities", https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8, 13 November 2026.