The ledger
The receipts.
Every advisory we can index, in one table, each row linking to Drupal's own publication. Filter by branch, severity or exploitation. This is the page you put in the appendix of a risk assessment.
| Date | Advisory | Project | Severity | Risk | CVE | Flags |
|---|---|---|---|---|---|---|
| 2026-11-04 | SA-CONTRIB-2026-315 | htmLawed | Moderately critical | 14/25 | CVE-2026-122079 | |
| 2026-11-04 | SA-CONTRIB-2026-314 | htmLawed | Moderately critical | 11/25 | CVE-2026-122080 | |
| 2026-11-04 | SA-CONTRIB-2026-313 | Islandora | Moderately critical | 10/25 | CVE-2026-122081 | |
| 2026-11-04 | SA-CONTRIB-2026-312 | Mime Mail | Moderately critical | 10/25 | CVE-2026-122082 | |
| 2026-11-04 | SA-CONTRIB-2026-311 | AdobeAnalytics | Moderately critical | 13/25 | CVE-2026-122083 | |
| 2026-11-04 | SA-CONTRIB-2026-310 | WordsOnline Connector | Moderately critical | 12/25 | CVE-2026-122084 | |
| 2026-11-04 | SA-CONTRIB-2026-309 | Extended HTML Filter | Moderately critical | 14/25 | CVE-2026-122078 | |
| 2026-11-04 | SA-CONTRIB-2026-308 | Allowed Languages | Less critical | 7/25 | CVE-2026-122077 | |
| 2026-11-04 | SA-CONTRIB-2026-307 | Password Separate Form | Moderately critical | 10/25 | CVE-2026-122076 | |
| 2026-11-04 | SA-CONTRIB-2026-306 | Scheduler | Moderately critical | 13/25 | CVE-2026-122075 | |
| 2026-11-04 | SA-CONTRIB-2026-305 | Reset Password Email/SMS OTP | Critical | 15/25 | CVE-2026-122074 | |
| 2026-11-04 | SA-CONTRIB-2026-304 | Name Field | Moderately critical | 12/25 | CVE-2026-122073 | |
| 2026-11-04 | SA-CONTRIB-2026-303 | Forum Access | Moderately critical | 10/25 | CVE-2026-122072 | |
| 2026-11-04 | SA-CONTRIB-2026-302 | Commerce Escrow | Moderately critical | 13/25 | CVE-2026-122071 | |
| 2026-11-04 | SA-CONTRIB-2026-301 | Commerce Product Alternative | Critical | 16/25 | CVE-2026-122070 | |
| 2026-11-04 | SA-CONTRIB-2026-300 | AlternativeCommerce PayPal Checkout | Moderately critical | 13/25 | CVE-2026-122069 | |
| 2026-11-04 | SA-CONTRIB-2026-299 | Highlight Js syntax highlighter | Critical | 16/25 | CVE-2026-122068 | |
| 2026-11-04 | SA-CONTRIB-2026-298 | REST & JSON API Authentication for Drupal | Critical | 17/25 | CVE-2026-122067 | |
| 2026-11-04 | SA-CONTRIB-2026-297 | Workflow Notifications | Critical | 16/25 | CVE-2026-122066 | |
| 2026-11-04 | SA-CONTRIB-2026-296 | Simple OAuth (OAuth2) & OpenID Connect | Critical | 15/25 | CVE-2026-122058 | |
| 2026-11-04 | SA-CONTRIB-2026-295 | S3 File System CORS Upload | Critical | 16/25 | CVE-2026-122057 | |
| 2026-11-04 | SA-CONTRIB-2026-294 | Content Synchronizer | Moderately critical | 14/25 | CVE-2026-118566 | |
| 2026-11-04 | SA-CONTRIB-2026-293 | Content Synchronizer | Critical | 17/25 | CVE-2026-118547 | |
| 2026-11-04 | SA-CONTRIB-2026-278 | GroupEx PRO ( Daxko ) integration | Critical | 17/25 | CVE-2026-118565 | |
| 2026-10-28 | SA-CONTRIB-2026-292 | Media Alias Display | Moderately critical | 11/25 | CVE-2026-118571 | |
| 2026-10-28 | SA-CONTRIB-2026-291 | Content Sync (content-sync.io) | Moderately critical | 12/25 | CVE-2026-118568 | |
| 2026-10-28 | SA-CONTRIB-2026-290 | OAuth2 Token Manager | Critical | 15/25 | CVE-2026-118573 | |
| 2026-10-28 | SA-CONTRIB-2026-289 | Field Permissions | Moderately critical | 13/25 | CVE-2026-118584 | |
| 2026-10-28 | SA-CONTRIB-2026-288 | Field Permissions | Moderately critical | 11/25 | CVE-2026-118583 | |
| 2026-10-28 | SA-CONTRIB-2026-287 | OpenID Connect Client | Moderately critical | 14/25 | CVE-2026-118554 | |
| 2026-10-28 | SA-CONTRIB-2026-286 | Stage File Proxy | Critical | 16/25 | CVE-2026-118576 | |
| 2026-10-28 | SA-CONTRIB-2026-285 | Signature pad widget | Critical | 16/25 | CVE-2026-118575 | |
| 2026-10-28 | SA-CONTRIB-2026-284 | OAuth Login - OAuth OIDC SSO | Critical | 15/25 | CVE-2026-118572 | |
| 2026-10-28 | SA-CONTRIB-2026-283 | Fasttoggle | Moderately critical | 13/25 | CVE-2026-118570 | |
| 2026-10-28 | SA-CONTRIB-2026-282 | Fasttoggle | Moderately critical | 13/25 | CVE-2026-118569 | |
| 2026-10-28 | SA-CONTRIB-2026-281 | CAPTCHA | Moderately critical | 13/25 | CVE-2026-118582 | |
| 2026-10-28 | SA-CONTRIB-2026-280 | Bulk Update User Roles | Moderately critical | 12/25 | CVE-2026-118567 | |
| 2026-10-28 | SA-CONTRIB-2026-279 | S3 File System | Moderately critical | 14/25 | CVE-2026-118574 | |
| 2026-10-28 | SA-CONTRIB-2026-277 | PayUmoney for Drupal Commerce | Critical | 16/25 | CVE-2026-118564 | |
| 2026-10-28 | SA-CONTRIB-2026-276 | CacheFlush | Critical | 16/25 | CVE-2026-118563 | |
| 2026-10-28 | SA-CONTRIB-2026-275 | Single Content Sync | Critical | 17/25 | CVE-2026-118562 | |
| 2026-10-28 | SA-CONTRIB-2026-274 | Single Content Sync | Critical | 17/25 | CVE-2026-118561 | |
| 2026-10-28 | SA-CONTRIB-2026-273 | AI (Artificial Intelligence) | Moderately critical | 11/25 | CVE-2026-118553 | |
| 2026-10-28 | SA-CONTRIB-2026-272Drupal AI module, XSS from unsanitised HTMX attributes. | AI (Artificial Intelligence) | Moderately critical | 14/25 | CVE-2026-118552 | |
| 2026-10-28 | SA-CONTRIB-2026-271 | AI (Artificial Intelligence) | Less critical | 8/25 | CVE-2026-118551 | |
| 2026-10-28 | SA-CONTRIB-2026-270 | AI (Artificial Intelligence) | Moderately critical | 10/25 | CVE-2026-118550 | |
| 2026-10-28 | SA-CONTRIB-2026-269 | AI (Artificial Intelligence) | Critical | 15/25 | CVE-2026-118549 | |
| 2026-10-28 | SA-CONTRIB-2026-268 | AI (Artificial Intelligence) | Moderately critical | 11/25 | CVE-2026-118548 | |
| 2026-10-28 | SA-CONTRIB-2026-267 | AI (Artificial Intelligence) | Moderately critical | 13/25 | CVE-2026-118546 | |
| 2026-10-28 | SA-CONTRIB-2026-266 | AI (Artificial Intelligence) | Moderately critical | 14/25 | CVE-2026-118545 | |
| 2026-10-14 | SA-CORE-2026-016 | Drupal core | Moderately critical | 12/25 | CVE-2026-108514 | |
| 2026-10-14 | SA-CORE-2026-015 | Drupal core | Moderately critical | 13/25 | CVE-2026-108515 | |
| 2026-10-14 | SA-CORE-2026-014Unauthenticated RCE via Field UI. Pre-announced 12 Oct; fixes shipped 14 Oct. | Drupal core | Critical | 19/25 | CVE-2026-108097 | |
| 2026-09-16 | SA-CORE-2026-013 | Drupal core | Moderately critical | 13/25 | – | |
| 2026-07-15 | SA-CORE-2026-012 | Drupal core | Moderately critical | 13/25 | CVE-2026-55805 | |
| 2026-07-15 | SA-CORE-2026-011 | Drupal core | Moderately critical | 14/25 | CVE-2026-15917 | |
| 2026-07-15 | SA-CORE-2026-010 | Drupal core | Moderately critical | 10/25 | CVE-2026-15916 | |
| 2026-06-17 | SA-CORE-2026-009 | Drupal core | Moderately critical | 11/25 | CVE-2026-55808 | |
| 2026-06-17 | SA-CORE-2026-008 | Drupal core | Moderately critical | 10/25 | CVE-2026-55807 | |
| 2026-06-17 | SA-CORE-2026-007 | Drupal core | Less critical | 9/25 | CVE-2026-55806 | |
| 2026-06-17 | SA-CORE-2026-006 | Drupal core | Moderately critical | 14/25 | CVE-2026-55804 | |
| 2026-06-17 | SA-CORE-2026-005PHP object injection, risk 18/25. One of six core advisories on a single day. | Drupal core | Critical | 18/25 | CVE-2026-55803 | |
| 2026-05-20 | SA-CORE-2026-004PostgreSQL SQL injection. Exploit attempts within 48 hours; CISA KEV on 22 May 2026. | Drupal core | Highly critical | 23/25 | CVE-2026-9082 | KEVexploited |
| 2026-04-15 | SA-CORE-2026-003 | Drupal core | Moderately critical | 13/25 | CVE-2026-6367 | |
| 2026-04-15 | SA-CORE-2026-002 | Drupal core | Moderately critical | 14/25 | CVE-2026-6366 | |
| 2026-04-15 | SA-CORE-2026-001 | Drupal core | Critical | 15/25 | CVE-2026-6365 | |
| 2025-11-12 | SA-CORE-2025-008 | Drupal core | Moderately critical | 10/25 | CVE-2025-13083 | |
| 2025-11-12 | SA-CORE-2025-007 | Drupal core | Moderately critical | 10/25 | CVE-2025-13082 | |
| 2025-11-12 | SA-CORE-2025-006 | Drupal core | Moderately critical | 14/25 | CVE-2025-13081 | |
| 2025-11-12 | SA-CORE-2025-005 | Drupal core | Moderately critical | 13/25 | CVE-2025-13080 | |
| 2025-03-19 | SA-CORE-2025-004 | Drupal core | Moderately critical | 13/25 | CVE-2025-31675 | |
| 2025-02-19 | SA-CORE-2025-003 | Drupal core | Moderately critical | 14/25 | CVE-2025-31674 | |
| 2025-02-19 | SA-CORE-2025-002 | Drupal core | Moderately critical | 13/25 | CVE-2025-31673 | |
| 2025-02-19 | SA-CORE-2025-001 | Drupal core | Critical | 17/25 | CVE-2025-3057 | |
| 2024-11-20 | SA-CORE-2024-008 | Drupal core | Moderately critical | 14/25 | CVE-2024-55638 | |
| 2024-11-20 | SA-CORE-2024-007 | Drupal core | Moderately critical | 14/25 | CVE-2024-55637 | |
| 2024-11-20 | SA-CORE-2024-006 | Drupal core | Less critical | 8/25 | CVE-2024-55636 | |
| 2024-11-20 | SA-CORE-2024-005 | Drupal core | Critical | 17/25 | CVE-2024-55635 | |
| 2024-11-20 | SA-CORE-2024-004 | Drupal core | Moderately critical | 10/25 | CVE-2024-55634 | |
| 2024-11-20 | SA-CORE-2024-003 | Drupal core | Moderately critical | 13/25 | CVE-2024-12393 | |
| 2024-10-16 | SA-CORE-2024-002 | Drupal core | Moderately critical | 13/25 | CVE-2024-11942 | |
| 2024-01-17 | SA-CORE-2024-001 | Drupal core | Moderately critical | 11/25 | CVE-2024-11941 | |
| 2023-09-20 | SA-CORE-2023-006 | Drupal core | Critical | 16/25 | CVE-2023-5256 | |
| 2023-04-19 | SA-CORE-2023-005 | Drupal core | Moderately critical | 13/25 | CVE-2023-31250 | |
| 2023-03-15 | SA-CORE-2023-004 | Drupal core | Moderately critical | 14/25 | – | |
| 2023-03-15 | SA-CORE-2023-003 | Drupal core | Moderately critical | 13/25 | – | |
| 2023-03-15 | SA-CORE-2023-002 | Drupal core | Moderately critical | 14/25 | – | |
| 2023-01-18 | SA-CORE-2023-001 | Drupal core | Moderately critical | 12/25 | – | |
| 2022-09-28 | SA-CORE-2022-016 | Drupal core | Critical | 18/25 | CVE-2022-39261 | |
| 2022-07-20 | SA-CORE-2022-015 | Drupal core | Moderately critical | 11/25 | CVE-2022-25276 | |
| 2022-07-20 | SA-CORE-2022-014 | Drupal core | Critical | 15/25 | CVE-2022-25277 | |
| 2022-07-20 | SA-CORE-2022-013 | Drupal core | Moderately critical | 12/25 | CVE-2022-25278 | |
| 2022-07-20 | SA-CORE-2022-012 | Drupal core | Moderately critical | 13/25 | CVE-2022-25275 | |
| 2022-06-10 | SA-CORE-2022-011 | Drupal core | Moderately critical | 13/25 | CVE-2022-31042 | |
| 2022-05-25 | SA-CORE-2022-010 | Drupal core | Moderately critical | 13/25 | CVE-2022-29248 | |
| 2022-04-20 | SA-CORE-2022-009 | Drupal core | Moderately critical | 13/25 | CVE-2022-25274 | |
| 2022-04-20 | SA-CORE-2022-008 | Drupal core | Moderately critical | 12/25 | CVE-2022-25273 | |
| 2022-03-21 | SA-CORE-2022-006 | Drupal core | Moderately critical | 11/25 | CVE-2022-24775 | |
| 2022-03-16 | SA-CORE-2022-005 | Drupal core | Moderately critical | 13/25 | CVE-2022-24728 | |
| 2022-02-16 | SA-CORE-2022-004 | Drupal core | Moderately critical | 12/25 | CVE-2022-25270 |
100 shown
This snapshot holds the 50 most recent core advisories (back to 2022) and the 50 most recent contributed-project advisories, which cover only 28 October to 4 November 2026, because that is how fast Drupal is publishing now. Severity is Drupal's own wording; risk is Drupal's own score out of 25. “Exploited” means the advisory or CISA states exploitation; “KEV” means the CVE is in CISA's Known Exploited Vulnerabilities catalogue. Full method on the methodology page.
Reading the ledger
Three patterns that survive filtering.#
Six advisories, one day
On 17 June 2026 Drupal published six core advisories in a single release window. On 14 October it published three, including the critical remote code execution.
Contributed projects dominate
In 2026 the contributed-project feed has reached SA-CONTRIB-2026-315. Core has reached 16. Coverage for contributed projects is opt-in, and the project's only remedy for an abandoned module is to uninstall it.
Critical is a regular word
27 of the 100 advisories indexed here are rated Critical. Drupal's scale runs to 25; anything at or above 20 is “highly critical”.
Sources
1Drupal.org: core security advisories feed
www.drupal.org/security/rss.xml
retrieved 8 Nov 2026
2Drupal.org: contributed-project security advisories feed
www.drupal.org/security/contrib/rss.xml
retrieved 8 Nov 2026
3CISA: Known Exploited Vulnerabilities catalog, v2026.11.06
www.cisa.gov/known-exploited-vulnerabilities-catalog
retrieved 6 Nov 2026
4Drupal.org: security risk levels defined
www.drupal.org/drupal-security-team/security-risk-levels-defined
retrieved 8 Nov 2026