search
Drupal Security Team
Trends
- 1Four New Full Members Join Drupal Security TeamโThrilled to announce that four provisional members have earned full membership on the Drupal Security Team! Welcome: ๐ซ๐ท
The Drupal Security Team has announced that four provisional members have earned full membership: Pierre Rudloff of France, Joseph Zhao of Australia, Bram Driesen of Belgium, and Swan Kalata of the United States. The team coordinates security fixes and advisories for the Drupal content management system, and the announcement congratulates the newcomers on completing the provisional period.
- 2Drupal Domain Login Restrict vulnerability allows authentication bypassโ๐จ EUVD-2026-113523 ๐ Score: n/a ๐ฆ Product: Domain Login Restrict ๐ข Vendor: Drupal ๐ Updated: 2026-10-30 ๐ Authentication
A new vulnerability, tracked as EUVD-2026-113523, has been disclosed in Drupal's Domain Login Restrict module. The flaw is classified as an authentication bypass using an alternate path or channel, meaning an attacker could log in through a route the module is supposed to block. No severity score has been assigned yet, and affected versions were not fully specified in the advisory. Administrators running the module are advised to watch for a patched release and review site access controls in the meantime.
- 3Drupal Webform REST module hit by missing authorization flawโผ๐จ EUVD-2026-107815 ๐ Score: n/a ๐ฆ Product: Webform REST ๐ข Vendor: Drupal ๐ Updated: 2026-10-22 ๐ Missing Authorization v
A new vulnerability, EUVD-2026-107815, has been disclosed in Drupal's Webform REST module. The missing authorization flaw allows forceful browsing, letting attackers access resources without proper permission checks. All versions from 0.0.0 through 4.2.1 are affected. No severity score has been assigned yet, but security teams running the module are expected to review and patch their sites.
- 4CSRF vulnerability reported in Drupal Tawk.to live chat moduleโผ๐จ EUVD-2026-107817 ๐ Score: n/a ๐ฆ Product: Tawk.to - Live chat application ๐ข Vendor: Drupal ๐ Updated: 2026-10-22 ๐ Cros
A cross-site request forgery vulnerability, tracked as EUVD-2026-107817, has been recorded for the Tawk.to live chat application module associated with Drupal. The flaw allows attackers to forge requests on behalf of authenticated users, potentially compromising sites that use the popular chat integration. No severity score has been published yet; administrators are advised to watch for a patched release.
- 5Authentication bypass vulnerability disclosed in Drupal REST & JSON API moduleโ๐จ EUVD-2026-107819 ๐ Score: n/a ๐ฆ Product: REST & JSON API Authentication for Drupal ๐ข Vendor: Drupal ๐ Updated: 2026-10
A new vulnerability, tracked as EUVD-2026-107819, has been disclosed in the REST & JSON API Authentication module for Drupal. The flaw allows authentication bypass through an alternate path or channel, meaning attackers could potentially gain access without valid credentials. No severity score has been assigned yet. Administrators running Drupal sites with this module are advised to monitor for patches and review their API authentication settings.
- 6Drupal patches two critical remote code execution flawsโ๐ค Drupal patched two critical RCE flaws: CVE-2026-108097 in core's Field UI module, CVE-2026-108099 in the contributed E
Drupal has released security updates fixing two critical remote code execution vulnerabilities: CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module. All currently supported versions of Drupal core are affected, and the project's security team warns that working exploits could emerge within hours or days, urging site administrators to apply the patches immediately.
- 7Drupal Warns of Rapid Exploitation Risk for Critical Remote Code FlawโDrupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Drupal has issued a warning about a critical remote code execution vulnerability in its core software, cautioning that it could be exploited quickly by attackers. The open-source content management system is urging administrators to apply security patches promptly to protect their websites. Site owners and security teams are being advised to update as soon as possible given the severity of the flaw.