DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
545
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 39High 72Medium 256Low 30
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-3165 | 7.5 | Apr 12 | The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2016-3163 | 7.5 | Apr 12 | The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2026-15081 | 7.4 | Jul 10 | Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072 Affected: 0.0.0 before 1.3.0 |
| CVE-2026-5343 | 7.4 | May 28 | SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031 Affected: 0.0.0 before 3.1.4 |
| CVE-2017-6924 | 7.4 | Jan 15 | REST API can bypass comment approval - Access Bypass - Moderately Critical Affected: Drupal 8 before 8.3.7 |
| CVE-2016-3167 | 7.4 | Apr 12 | Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2016-3164 | 7.4 | Apr 12 | Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2026-76782 | 7.3 | Sep 2 | Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 Affected: *.* |
| CVE-2026-76759 | 7.3 | Sep 2 | Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 Affected: *.* |
| CVE-2024-13311 | 7.3 | Jan 9 | Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075 Affected: *.* |
| CVE-2024-13291 | 7.3 | Jan 9 | Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057 Affected: 7.x-1.0 before 7.x-1.4 |
| CVE-2022-25277 | 7.2 | Apr 26 | Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server… Affected: 8.0.0 before 9.3.19; 9.4.0 before 9.4.3 |
| CVE-2024-13268 | 6.8 | Jan 9 | Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032 Affected: 7.x-1.0 before 7.x-1.23 |
| CVE-2016-9451 | 6.8 | Nov 25 | Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2026-6366 | 6.6 | May 19 | Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002 Affected: 8.0.0 before 10.5.9; 10.6.0 before 10.6.7; 11.0.0 before 11.2.11; 11.3.0 before 11.3.7 |
| CVE-2024-13300 | 6.6 | Jan 9 | Print Anything - Critical - Unsupported - SA-CONTRIB-2024-066 Affected: *.* |
| CVE-2024-13299 | 6.6 | Jan 9 | Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065 Affected: *.* |
| CVE-2024-13297 | 6.6 | Jan 9 | Eloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-063 Affected: 7.x-* before 7.x-1.15 |
| CVE-2024-13296 | 6.6 | Jan 9 | Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062 Affected: 0.0.0 before 4.0.1 |
| CVE-2024-13295 | 6.6 | Jan 9 | Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061 Affected: 7.x-* before 7.x-3.3 |
| CVE-2026-84923 New | 6.5 | Oct 22 | Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124 Affected: 0.0.0 before 2.4.0 |
| CVE-2026-84917 New | 6.5 | Oct 22 | Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127 Affected: 0.0.0 before 2.0.2 |
| CVE-2026-87936 New | 6.5 | Oct 22 | amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134 Affected: 0.0.0 before 1.3.7; 1.4.0 before 1.4.3 |
| CVE-2026-87937 New | 6.5 | Oct 22 | Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135 Affected: 0.0.0 before 2.0.4; 2.1.0 before 2.1.3 |
| CVE-2026-87943 New | 6.5 | Oct 22 | SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96385 New | 6.5 | Oct 22 | REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96380 New | 6.5 | Oct 22 | CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189 Affected: 1.0.0 before 1.0.2 |
| CVE-2026-96386 New | 6.5 | Oct 22 | Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190 Affected: 0.0.0 before 3.2.1 |
| CVE-2026-13242 | 6.5 | Jul 10 | Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062 Affected: 0.0.0 before 3.15.0 |
| CVE-2026-13241 | 6.5 | Jul 10 | Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061 Affected: 0.0.0 before 1.21.0 |
| CVE-2026-13240 | 6.5 | Jul 10 | Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060 Affected: 0.0.0 before 1.21.0 |
| CVE-2026-13239 | 6.5 | Jul 10 | WissKI - Critical - Access bypass - SA-CONTRIB-2026-059 Affected: 0.0.0 before 4.2.0 |
| CVE-2026-1556 | 6.5 | Mar 26 | Information disclosure via file URI overwrite in File (Field) Paths Affected: 7.x-1.0 before 7.x-1.3 |
| CVE-2026-3531 | 6.5 | Mar 26 | OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026 Affected: 0.0.0 before 1.5.0 |
| CVE-2026-3527 | 6.5 | Mar 26 | AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022 Affected: 0.0.0 before 3.1.0 |
| CVE-2026-3214 | 6.5 | Mar 25 | CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015 Affected: 0.0.0 before 1.17.0; 2.0.0 before 2.0.10 |
| CVE-2024-13310 | 6.5 | Jan 9 | Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074 Affected: *.* |
| CVE-2024-13243 | 6.5 | Jan 9 | Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007 Affected: 0.0.0 before 1.1.1 |
| CVE-2023-31250 | 6.5 | Apr 26 | The file download facility doesn't sufficiently sanitize file paths in certain situations Affected: 7.0 before 7.96; 9.4 before 9.4.14; 9.5 before 9.5.8; 10.0 before 10.0.8 |
| CVE-2022-25278 | 6.5 | Apr 26 | Under certain circumstances, the Drupal core form API evaluates form element access incorrectly Affected: 8.0.0 before 9.3.19; 9.4.0 before 9.4.3 |
| CVE-2022-25270 | 6.5 | Feb 17 | The Quick Edit module does not properly check entity access in some circumstances Affected: 9.2.0 before 9.2.13; 9.3.0 before 9.3.6 |
| CVE-2020-13676 | 6.5 | Feb 11 | The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data Affected: 8.9.0 before 8.9.19; 9.1.0 before 9.1.13; 9.2.0 before 9.2.6 |
| CVE-2020-13674 | 6.5 | Feb 11 | The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues Affected: 8.9.0 before 8.9.19; 9.1.0 before 9.1.13; 9.2.0 before 9.2.6 |
| CVE-2010-2473 | 6.5 | Nov 7 | Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances Affected: 5.0 before 5.22; 6.0 before 6.16 |
| CVE-2017-6923 | 6.5 | Jan 22 | Access bypass in Drupal 8 views Affected: 8.x before 8.3.7 |
| CVE-2017-6922 | 6.5 | Jan 22 | Files uploaded by anonymous users into a private file system can be accessed by other anonymous users Affected: Drupal 8 before 8.3.3; Drupal 7 before 7.55 |
| CVE-2018-14773 | 6.5 | Aug 3 | An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0… Affected: 8.0.0 before 8.5.6 |
| CVE-2017-6931 | 6.5 | Mar 1 | In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for Affected: 8.4.0 before 8.4.5 |
| CVE-2016-9452 | 6.5 | Nov 25 | The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2026-96376 New | 6.4 | Oct 22 | Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177 Affected: 0.0.0 before 7.0.1 |
The 500 most important CVEs for this product (exploited first, then by severity)