DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
545
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 39High 72Medium 256Low 30
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-3168 | 6.4 | Apr 12 | The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2024-13272 | 6.3 | Jan 9 | Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036 Affected: 0.0.0 before 1.23.0; 2.0.0 before 2.0.2 |
| CVE-2026-81201 | 6.1 | Sep 2 | Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116 Affected: 0.0.0 before 9.5.3 |
| CVE-2026-81160 | 6.1 | Sep 2 | Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117 Affected: 0.0.0 before 2.1.0 |
| CVE-2026-16638 | 6.1 | Aug 25 | Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080 Affected: 0.0.0 before 1.0.8 |
| CVE-2026-16640 | 6.1 | Aug 25 | Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082 Affected: 0.0.0 before 1.12.0 |
| CVE-2026-58588 | 6.1 | Jul 10 | Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066 Affected: 0.0.0 before 1.4.2; 1.5.0 before 1.5.2; 1.6.0 before 1.6.1; 1.7.0 before 1.7.1 |
| CVE-2026-58587 | 6.1 | Jul 10 | Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065 Affected: 0.0.0 before 1.4.2; 1.5.0 before 1.5.2; 1.6.0 before 1.6.1; 1.7.0 before 1.7.1 |
| CVE-2026-13234 | 6.1 | Jul 10 | AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054 Affected: 0.0.0 before 1.2.17; 1.3.0 before 1.3.8; 1.4.0 before 1.4.3 |
| CVE-2026-13231 | 6.1 | Jul 10 | Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051 Affected: 0.0.0 before 2.8.0 |
| CVE-2026-10770 | 6.1 | Jul 10 | Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042 Affected: 0.0.0 before 9.7.1 |
| CVE-2026-6871 | 6.1 | May 19 | Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033 Affected: 0.0.0 before 2.0.2 |
| CVE-2026-6367 | 6.1 | May 19 | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003 Affected: 11.3.0 before 11.3.7 |
| CVE-2026-6365 | 6.1 | May 19 | Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001 Affected: 8.0.0 before 10.5.9; 10.6.0 before 10.6.7; 11.0.0 before 11.2.11; 11.3.0 before 11.3.7 |
| CVE-2026-6095 | 6.1 | May 19 | Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032 Affected: 0.0.0 before 2.0.16 |
| CVE-2026-3529 | 6.1 | Mar 26 | Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024 Affected: 0.0.0 before 1.1.14 |
| CVE-2026-3528 | 6.1 | Mar 26 | Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023 Affected: 0.0.0 before 1.0.4 |
| CVE-2026-3217 | 6.1 | Mar 25 | SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018 Affected: 0.0.0 before 3.1.3 |
| CVE-2026-2349 | 6.1 | Mar 25 | UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010 Affected: 0.0.0 before 1.0.1; 1.1.0 before 1.1.1 |
| CVE-2025-3057 | 6.1 | Mar 31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects… Affected: 8.0.0 before 10.3.13; 10.4.0 before 10.4.3; 11.0.0 before 11.0.12; 11.1.0 before 11.1.3 |
| CVE-2024-13301 | 6.1 | Jan 9 | OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067 Affected: 3.0.0 before 3.44.0; 4.0.0 before 4.0.19 |
| CVE-2024-13283 | 6.1 | Jan 9 | Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047 Affected: 0.0.0 before 2.0.9 |
| CVE-2024-55635 | 6.1 | Dec 10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects… Affected: 7.0 before 7.102 |
| CVE-2022-25276 | 6.1 | Apr 26 | The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain Affected: 9.3.0 before 9.3.19; 9.4.0 before 9.4.3 |
| CVE-2020-13672 | 6.1 | Feb 11 | Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances Affected: before 7.80; 8.9.0 before 8.9.14; 9.0.0 before 9.0.12; 9.1.0 before 9.1.7 |
| CVE-2020-13669 | 6.1 | Feb 11 | Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS Affected: 8.8.0 before 8.8.10; 8.9.0 before 8.9.6; 9.0.0 before 9.0.6 |
| CVE-2020-13668 | 6.1 | Feb 11 | Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability Affected: 8.8.0 before 8.8.10; 8.9.0 before 8.9.6; 9.0.0 before 9.0.6 |
| CVE-2021-41184 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: 7.0 before 7.86; 9.2.0 before 9.2.11; 9.3.0 before 9.3.3 |
| CVE-2021-41183 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: 7.0 before 7.86; 9.2.0 before 9.2.11; 9.3.0 before 9.3.3 |
| CVE-2021-41182 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: 7.0 before 7.86 |
| CVE-2020-13688 | 6.1 | Jun 11 | Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability Affected: 8.8.0 before 8.8.10; 8.9.0 before 8.9.6; 9.0.0 before 9.0.6 |
| CVE-2021-33829 | 6.1 | Jun 9 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript… Affected: 8.9.0 before 8.9.16; 9.0.0 before 9.0.14; 9.1.0 before 9.1.9 |
| CVE-2020-13662 | 6.1 | May 5 | Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL Affected: 7.0 through 7.70 |
| CVE-2020-13666 | 6.1 | May 5 | Cross-site scripting vulnerability in Drupal Core Affected: 7.0 before 7.73; 8.8.0 before 8.8.10; 8.9.0 before 8.9.6; 9.0.0 before 9.0.6 |
| CVE-2020-11022 | 6.1 | Apr 29 | In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e Affected: 7.0 before 7.70; 8.7.0 before 8.7.14; 8.8.0 before 8.8.6 |
| CVE-2020-9281 | 6.1 | Mar 7 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted… Affected: 8.7.0 before 8.7.12; 8.8.0 before 8.8.4 |
| CVE-2011-2714 | 6.1 | Jan 14 | A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display Affected: 6.20 |
| CVE-2010-2250 | 6.1 | Nov 7 | Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack Affected: 5.0 before 5.22; 6.0 before 6.16 |
| CVE-2010-2471 | 6.1 | Nov 6 | Drupal versions 5.x and 6.x has open redirection Affected: 5.0 before 5.22; 6.0 before 6.16 |
| CVE-2019-11876 | 6.1 | May 24 | In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS Affected: 8.7.0 |
| CVE-2019-11358 | 6.1 | Apr 20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution Affected: 7.0 before 7.66; 8.5.0 before 8.5.15; 8.6.0 before 8.6.15 |
| CVE-2018-7603 | 6.1 | Jan 15 | Search Autocomplete Affected: 7.x-4.x before 7.x-4.8 |
| CVE-2018-9861 | 6.1 | Apr 19 | Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before… Affected: 8.0.0 before 8.4.7; 8.5.0 before 8.5.2 |
| CVE-2017-6929 | 6.1 | Mar 1 | A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains Affected: 7.0 before 7.57; 8.0.0 before 8.4.0 |
| CVE-2017-6927 | 6.1 | Mar 1 | Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before… Affected: 7.0 before 7.57; 8.4.0 before 8.4.5 |
| CVE-2015-7943 | 6.1 | Oct 18 | Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2015-2750 | 6.1 | Sep 13 | Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2015-2749 | 6.1 | Sep 13 | Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2016-7571 | 6.1 | Oct 3 | Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2010-5312 | 6.1 | Nov 24 | Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via… Affected: 7.0 before 7.86 |
The 500 most important CVEs for this product (exploited first, then by severity)