DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
566
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 39High 77Medium 272Low 30
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-13671 In wildKEV | 8.8 | Nov 20 | Drupal core Un-restricted Upload of File Affected: 9.0 versions prior to 9.0.8; 8.9 versions prior to 8.9.9; 8.8 versions prior to 8.8.11; 7 versions prior to 7.74 |
| CVE-2019-6340 In wildKEV | 8.1 | Feb 21 | Drupal core - Highly critical - Remote Code Execution Affected: 8.5 before 8.5.11; 8.6 before 8.6.10 |
| CVE-2020-28949 In wildKEV | 7.8 | Nov 19 | PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability Affected: 7.0 before 7.75; 8.0.0 before 8.9.10; 8.8.0 before 8.8.12; 9.0.0 before 9.0.9 |
| CVE-2020-36193 In wildKEV | 7.5 | Jan 18 | PEAR Archive_Tar Improper Link Resolution Vulnerability Affected: 7.0 before 7.78; 8.9.0 before 8.9.13; 9.0.0 before 9.0.11; 9.1.0 before 9.1.3 |
| CVE-2026-0945 | 8.8 | Feb 4 | Role Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-002 Affected: 1.3.0 before 1.5.0 |
| CVE-2024-13284 | 8.8 | Jan 9 | Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048 Affected: 0.0.0 before 2.13.0; 3.0.0 before 3.0.5 |
| CVE-2024-13282 | 8.8 | Jan 9 | Block permissions - Moderately critical - Access bypass - SA-CONTRIB-2024-046 Affected: 1.0.0 before 1.2.0 |
| CVE-2024-13260 | 8.8 | Jan 9 | Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024 Affected: 0.0.0 before 2.1.1 |
| CVE-2024-13251 | 8.8 | Jan 9 | Registration role - Critical - Access bypass - SA-CONTRIB-2024-015 Affected: 0.0.0 before 2.0.1 |
| CVE-2024-13250 | 8.8 | Jan 9 | Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014 Affected: 0.0.0 before 1.0.6 |
| CVE-2024-13244 | 8.8 | Jan 9 | Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008 Affected: 0.0.0 before 6.0.3 |
| CVE-2020-13663 | 8.8 | Jun 11 | Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities Affected: 7.0 before 7.72; 8.8.0 before 8.8.8; 8.9.0 before 8.9.1; 9.0.0 before 9.0.1 |
| CVE-2020-13664 | 8.8 | May 5 | Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances Affected: 8.8.0 before 8.8.8; 8.9.0 before 8.9.1; 9.0.0 before 9.0.1 |
| CVE-2016-6211 | 8.8 | Sep 9 | The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2026-18985 | 8.1 | Aug 25 | Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093 Affected: 0.0.0 before 2.1.1 |
| CVE-2026-13244 | 8.1 | Jul 10 | Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064 Affected: 0.0.0 before 2.4.0 |
| CVE-2026-55810 | 8.1 | Jul 10 | Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050 Affected: 0.0.0 before 3.0.2 |
| CVE-2026-55809 | 8.1 | Jul 10 | Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049 Affected: 0.0.0 before 1.2 |
| CVE-2025-14472 | 8.1 | Jan 28 | Acquia Content Hub - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-125 Affected: 0.0.0 before 3.6.4; 3.7.0 before 3.7.3 |
| CVE-2025-13982 | 8.1 | Jan 28 | Login Time Restriction - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-120 Affected: 0.0.0 before 1.0.3 |
| CVE-2024-55634 | 8.1 | Dec 10 | A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8 Affected: 8.0.0 before 10.2.11; 10.3.0 before 10.3.9; 11.0.0 before 11.0.8 |
| CVE-2022-29248 | 8.1 | May 25 | Guzzle is a PHP HTTP client Affected: 9.2.0 before 9.2.20; 9.3.0 before 9.3.14 |
| CVE-2017-6930 | 8.1 | Mar 1 | In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback… Affected: 8.4.0 before 8.4.5 |
| CVE-2017-6926 | 8.1 | Mar 1 | In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add… Affected: 8.4.0 before 8.4.5 |
| CVE-2017-6381 | 8.1 | Mar 16 | A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2016-5385 | 8.1 | Jul 19 | PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in… Affected: 8.0.0 before 8.1.7 |
| CVE-2016-3171 | 8.1 | Apr 12 | Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2016-3169 | 8.1 | Apr 12 | The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2016-3162 | 8.1 | Apr 12 | The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2019-6338 | 8.0 | Jan 22 | third-party PEAR Archive_Tar library updates Affected: 7.x before 7.62; 8.6.x before 8.6.6.; 8.5.x before 8.5.9 |
| CVE-2020-28948 | 7.8 | Nov 19 | Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked Affected: 7.0 before 7.75; 8.0.0 before 8.9.10; 8.8.0 before 8.8.12; 9.0.0 before 9.0.9 |
| CVE-2026-96365 New | 7.5 | Oct 22 | Webform - Less critical - Denial of service - SA-CONTRIB-2026-170 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-18259 | 7.5 | Aug 25 | Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090 Affected: 0.0.0 before 3.1.2 |
| CVE-2026-4933 | 7.5 | Mar 26 | Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029 Affected: 0.0.0 before 1.7.0 |
| CVE-2026-3573 | 7.5 | Mar 26 | AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028 Affected: 0.0.0 before 1.1.11; 1.2.0 before 1.2.12 |
| CVE-2025-14840 | 7.5 | Jan 28 | HTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-126 Affected: 0.0.0 before 9.3.13; 10.0.0 before 10.0.2; 11.0.0 before 11.0.1 |
| CVE-2026-0750 | 7.5 | Jan 28 | Payment bypass in Commerce Paybox Affected: 7-x-1.0 through 7.x-1.5 |
| CVE-2025-31674 | 7.5 | Mar 31 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from… Affected: 8.0.0 before 10.3.13; 10.4.0 before 10.4.3; 11.0.0 before 11.0.12; 11.1.0 before 11.1.3 |
| CVE-2024-13276 | 7.5 | Jan 9 | File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040 Affected: 7.x-* before 7.x-2.39 |
| CVE-2024-13267 | 7.5 | Jan 9 | Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031 Affected: 7.x-1.0 before 7.x-1.3 |
| CVE-2024-13265 | 7.5 | Jan 9 | Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029 Affected: 0.0.0 before 3.1.2 |
| CVE-2024-13259 | 7.5 | Jan 9 | Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023 Affected: 0.0.0 before 3.0.2 |
| CVE-2024-13256 | 7.5 | Jan 9 | Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020 Affected: 0.0.0 before 2.0.4 |
| CVE-2024-13255 | 7.5 | Jan 9 | RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019 Affected: 7.x-2.0 before 7.x-2.10 |
| CVE-2024-13254 | 7.5 | Jan 9 | REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018 Affected: 0.0.0 before 3.0.1 |
| CVE-2024-13240 | 7.5 | Jan 9 | Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004 Affected: 0.0.0 before 12.05 |
| CVE-2024-11941 | 7.5 | Dec 5 | A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8 Affected: 8.0.0 before 10.1.8; 10.2.0 before 10.2.2 |
| CVE-2024-22362 | 7.5 | Jan 16 | Drupal contains a vulnerability with improper handling of structural elements Affected: 9.3.6 |
| CVE-2023-5256 | 7.5 | Sep 28 | In certain scenarios, Drupal's JSON:API module will output error backtraces Affected: 8.7.0 before 9.5.11; 10.0.0 before 10.0.11; 10.1.0 before 10.1.4 |
| CVE-2022-25275 | 7.5 | Apr 26 | In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the… Affected: 7.0 before 7.91; 8.0.0 before 9.3.19; 9.4.0 before 9.4.3 |
The 500 most important CVEs for this product (exploited first, then by severity)