Drupal · weakness class

Server-Side Request Forgery

8 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097CVE-2026-73474Drupal · CVSS 5.3 · 0.3% likely
CWE-918
Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017CVE-2026-3216Drupal · CVSS 5 · 0.3% likely
CWE-918
AI SEO Link Advisor - Less critical - Server-side Request Forgery - SA-CONTRIB-2025-095CVE-2025-8675Drupal · CVSS 4.7 · 0.3% likely
CWE-918
Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008CVE-2026-55807Drupal · CVSS 3.1 · 0.2% likely
CWE-918
OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053CVE-2026-13233Drupal · CVSS 3.3 · 0.2% likely
CWE-918
Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213CVE-2026-107310Drupal · CVSS 4.3 · 0.2% likely
CWE-918
OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025CVE-2026-3530Drupal · CVSS 4.3 · 0.2% likely
CWE-918
SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151CVE-2026-87953Drupal · CVSS 3.3 · 0.2% likely
CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.