VENDOR

Drupal vulnerabilities: CVEs, exploitation and patches

Every Drupal CVE reviewed by Diras Labs analysts, newest first, with exploitation status and fixes.

CVE-2026-73475
Commerce PayPal forceful browsing lets unauthenticated users access Drupal Commerce PayPal · Sep 30, 2026
- PATCH AVAILABLE
CRITICAL 9.1
CVE-2026-16639
Internationalization Single Sign-On authentication bypass Drupal Internationalization Single Sign-On · Sep 29, 2026
- PATCH AVAILABLE
CRITICAL 9.8
CVE-2026-16641
Commerce Elavon input validation flaw allows unauthenticated remote compromise Drupal Commerce Elavon · Sep 29, 2026
CRITICAL 9.8