Drupal Vulnerabilities and Affected Products
Vulnerabilities associated with AI (Artificial Intelligence).
Products
Clear product- Drupal Core49 vulnerabilities
- Core21 vulnerabilities
- AI (Artificial Intelligence)8 vulnerabilities
- Open Social8 vulnerabilities
- Enterprise MFA - TFA for Drupal6 vulnerabilities
- COOKiES Consent Management4 vulnerabilities
- Drupal4 vulnerabilities
- Drupal Canvas4 vulnerabilities
- Two-factor Authentication (TFA)4 vulnerabilities
- Authenticator Login3 vulnerabilities
- Facets3 vulnerabilities
- Login Disable3 vulnerabilities
- One Time Password3 vulnerabilities
- OpenID Connect / OAuth client3 vulnerabilities
- Tagify3 vulnerabilities
- Access code2 vulnerabilities
- Acquia DAM2 vulnerabilities
- Advanced Content Feedback (aka admin_feedback)2 vulnerabilities
- AI Agents2 vulnerabilities
- Anti-Spam by CleanTalk2 vulnerabilities
- CivicTheme Design System2 vulnerabilities
- Colorbox2 vulnerabilities
- Data-module2 vulnerabilities
- drupal_core2 vulnerabilities
- ECA: Event - Condition - Action2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3. CWE-862Jul 10, 2026 | CVSS3.3v3.1 | EPSS0.161% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-13234MEDIUM | AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3. CWE-79Jul 10, 2026 | CVSS6.1v3.1 | EPSS0.181% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-3573HIGH | AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.1.11, from 1.2.0 before 1.2.12. CWE-863Mar 26, 2026 | CVSS7.5v3.1 | EPSS0.232% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-13981MEDIUM | AI (Artificial Intelligence) - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-119Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.7, from 1.1.0 before 1.1.7, from 1.2.0 before 1.2.4. CWE-79Jan 28, 2026 | CVSS4.4v3.1 | EPSS0.118% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5. CWE-78Mar 31, 2025 | CVSS-v4.0 | EPSS0.721% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5. CWE-78Mar 31, 2025 | CVSS-v4.0 | EPSS0.734% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3. CWE-862Mar 31, 2025 | CVSS-v4.0 | EPSS0.352% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Intelligence): from 1.0.0 before 1.0.2. CWE-352Mar 31, 2025 | CVSS-v4.0 | EPSS0.21% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |