DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
569
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 39High 77Medium 274Low 31
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-25273 | 7.5 | Apr 26 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation Affected: 8.0.0 before 9.2.18; 9.3.0 before 9.3.12 |
| CVE-2022-39261 | 7.5 | Sep 28 | Twig is a template language for PHP Affected: 8.0.0 before 9.3.22; 9.4.0 before 9.4.7 |
| CVE-2022-31043 | 7.5 | Jun 10 | Guzzle is an open source PHP HTTP client Affected: 9.2.0 before 9.2.21; 9.3.0 before 9.3.16; 9.4.0; 9.4.0; 9.4.0 |
| CVE-2022-31042 | 7.5 | Jun 10 | Guzzle is an open source PHP HTTP client Affected: 9.2.0 before 9.2.21; 9.3.0 before 9.3.16; 9.4.0; 9.4.0; 9.4.0 |
| CVE-2022-24775 | 7.5 | Mar 21 | guzzlehttp/psr7 is a PSR-7 HTTP message library Affected: 8.0.0 before 9.2.16; 9.3.0 before 9.3.9 |
| CVE-2022-24729 | 7.5 | Mar 16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor Affected: 8.0.0 before 9.2.15; 9.3.0 before 9.3.8 |
| CVE-2022-25271 | 7.5 | Feb 16 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation Affected: 7.0.0 before 7.88; 9.2.0 before 9.2.13; 9.3.0 before 9.3.6 |
| CVE-2020-13677 | 7.5 | Feb 11 | Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass Affected: 8.0.0 before 8.9.19; 9.1.0 before 9.1.13; 9.2.0 before 9.2.6 |
| CVE-2020-13670 | 7.5 | Feb 11 | Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access… Affected: 8.8.0 before 8.8.10; 8.9.0 before 8.9.6; 9.0.0 before 9.0.6 |
| CVE-2011-2726 | 7.5 | Nov 15 | An access bypass issue was found in Drupal 7.x before version 7.5 Affected: 7.0 before 7.5 |
| CVE-2019-10911 | 7.5 | May 16 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a… Affected: 8.5.0 before 8.5.15; 8.6.0 before 8.6.15 |
| CVE-2017-6919 | 7.5 | Apr 20 | Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH… Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2017-6379 | 7.5 | Mar 16 | Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF Affected: 8.2.0; 8.2.0; 8.2.0; 8.2.0; 8.2.0; 8.2.0; +6 more |
| CVE-2017-6377 | 7.5 | Mar 16 | When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass Affected: 8.2.0; 8.2.0; 8.2.0; 8.2.0; 8.2.0; 8.2.0; +6 more |
| CVE-2016-9450 | 7.5 | Nov 25 | The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2016-3165 | 7.5 | Apr 12 | The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2016-3163 | 7.5 | Apr 12 | The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2026-15081 | 7.4 | Jul 10 | Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072 Affected: 0.0.0 before 1.3.0 |
| CVE-2026-5343 | 7.4 | May 28 | SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031 Affected: 0.0.0 before 3.1.4 |
| CVE-2017-6924 | 7.4 | Jan 15 | REST API can bypass comment approval - Access Bypass - Moderately Critical Affected: Drupal 8 before 8.3.7 |
| CVE-2016-3167 | 7.4 | Apr 12 | Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2016-3164 | 7.4 | Apr 12 | Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2026-76782 | 7.3 | Sep 2 | Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 Affected: *.* |
| CVE-2026-76759 | 7.3 | Sep 2 | Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 Affected: *.* |
| CVE-2024-13311 | 7.3 | Jan 9 | Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075 Affected: *.* |
| CVE-2024-13291 | 7.3 | Jan 9 | Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057 Affected: 7.x-1.0 before 7.x-1.4 |
| CVE-2022-25277 | 7.2 | Apr 26 | Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server… Affected: 8.0.0 before 9.3.19; 9.4.0 before 9.4.3 |
The 500 most important CVEs for this product (exploited first, then by severity)