Drupal security updates, in plain English ยท Modules and themes
Modules and themes with a security release
25 so far, most widely used first, with Drupal core itself at the top when it has had a release. Each page holds every security release for that project that this site has covered, newest first, with what it does, who could exploit the hole and what to tell your developer.
Looking for one module in particular? The search box on the main page finds it faster.
- Easy Breadcrumb, 106,436 sites: 1 release, latest 7 October 2026
- Menu Link Attributes, 91,515 sites: 1 release, latest 7 October 2026
- Leaflet, 30,905 sites: 1 release, latest 7 October 2026
- Linked Field, 13,136 sites: 1 release, latest 7 October 2026
- MathJax: LaTeX for Drupal, 8,240 sites: 1 release, latest 7 October 2026
- Permissions by Term, 6,359 sites: 1 release, latest 7 October 2026
- Gutenberg, 5,103 sites: 1 release, latest 7 October 2026
- Country, 4,458 sites: 1 release, latest 7 October 2026
- Examples for Developers, 797 sites: 1 release, latest 7 October 2026
- Two Factor Authentication - TFA / Passwordless Login, 651 sites: 1 release, latest 7 October 2026
- Xray Audit, 641 sites: 1 release, latest 7 October 2026
- ECA Helper, 332 sites: 1 release, latest 7 October 2026
- Orphans Media, 261 sites: 1 release, latest 7 October 2026
- Block AJAX, 222 sites: 1 release, latest 7 October 2026
- Freelinking, 220 sites: 1 release, latest 7 October 2026
- Restrict route by IP, 213 sites: 1 release, latest 7 October 2026
- Inline Formatter Field, 170 sites: 1 release, latest 7 October 2026
- DKAN, 146 sites: 1 release, latest 7 October 2026
- Views Share, 25 sites: 1 release, latest 7 October 2026
- SmartLinker AI, 15 sites: 1 release, latest 7 October 2026
- Inline Entity Form Dialog, 13 sites: 1 release, latest 7 October 2026
- Entity Reference Manager (Merge entities), 4 sites: 1 release, latest 7 October 2026
- Actstream: 1 release, latest 7 October 2026
- Advanced Filesystem: 1 release, latest 7 October 2026
- Authenticator Login Plus (2FA): 2 releases, latest 7 October 2026
Not sure what your site is running?
Send me your Drupal site's address.
I'll tell you what I can see from outside, what the Drupal 10 end of life on 9 December means for it, and what it would cost to have me keep it patched. There's no charge for that and no obligation. peter@peterbrady.co.uk