DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
586
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 39High 81Medium 286Low 32
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-2348 | 5.4 | Mar 25 | Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009 Affected: 0.0.0 before 1.0.5; 2.0.0 before 2.0.1 |
| CVE-2025-13983 | 5.4 | Jan 28 | Tagify - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-121 Affected: 0.0.0 before 1.2.44 |
| CVE-2025-13979 | 5.4 | Jan 28 | Mini site - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-117 Affected: 0.0.0 before 3.0.2 |
| CVE-2025-14556 | 5.4 | Jan 14 | XSS in Drupal 7 Flag Module Affected: 7.x-3.0 through 7.x-3.9 |
| CVE-2025-12760 | 5.4 | Nov 18 | Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-115 Affected: 0.0.0 before 2.0.6 |
| CVE-2025-31675 | 5.4 | Mar 31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects… Affected: 8.0.0 before 10.3.14; 10.4.0 before 10.4.5; 11.0.0 before 11.0.13; 11.1.0 before 11.1.5 |
| CVE-2024-13309 | 5.4 | Jan 9 | Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073 Affected: 2.0.0 before 2.1.1 |
| CVE-2024-13294 | 5.4 | Jan 9 | POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060 Affected: 0.0.0 before 1.0.2 |
| CVE-2024-13289 | 5.4 | Jan 9 | Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055 Affected: 0.0.0 before 1.0.18 |
| CVE-2024-13287 | 5.4 | Jan 9 | Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051 Affected: 0.0.0 before 1.0.1 |
| CVE-2024-13286 | 5.4 | Jan 9 | SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050 Affected: 0.0.0 before 2.1.2 |
| CVE-2024-13273 | 5.4 | Jan 9 | Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037 Affected: 0.0.0 before 12.3.8; 12.4.0 before 12.4.5 |
| CVE-2024-13252 | 5.4 | Jan 9 | TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016 Affected: 0.0.0 before 6.5.0 |
| CVE-2024-13249 | 5.4 | Jan 9 | Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013 Affected: 7.x-1.0 before 7.x-1.2 |
| CVE-2024-13245 | 5.4 | Jan 9 | CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009 Affected: 1.0.0 before 1.0.1 |
| CVE-2024-13238 | 5.4 | Jan 9 | Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002 Affected: 0.0.0 before 1.3.0 |
| CVE-2024-13237 | 5.4 | Jan 9 | File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001 Affected: 7.x-* before 7.x-2.38 |
| CVE-2024-12393 | 5.4 | Dec 10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects… Affected: 8.8.0 before 10.2.11; 10.3.0 before 10.3.9; 11.0.0 before 11.0.8 |
| CVE-2022-25274 | 5.4 | Apr 26 | Drupal 9.3 implemented a generic entity access API for entity revisions Affected: 9.3.0 before 9.3.12 |
| CVE-2022-24728 | 5.4 | Mar 16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor Affected: 8.0.0 before 9.2.15; 9.3.0 before 9.3.8 |
| CVE-2021-41165 | 5.4 | Nov 17 | CKEditor4 is an open source WYSIWYG HTML editor Affected: 8.9.0 before 8.9.20; 9.1.0 before 9.1.14; 9.2.0 before 9.2.9 |
| CVE-2021-41164 | 5.4 | Nov 17 | CKEditor4 is an open source WYSIWYG HTML editor Affected: 8.9.0 before 8.9.20; 9.1.0 before 9.1.14; 9.2.0 before 9.2.9 |
| CVE-2019-10909 | 5.4 | May 16 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user… Affected: 8.5.0 before 8.5.15; 8.6.0 before 8.6.15 |
| CVE-2019-6341 | 5.4 | Mar 26 | In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14 Affected: 7.0 before 7.65; 8.5.0 before 8.5.14; 8.6.0 before 8.6.13 |
| CVE-2026-84914 New | 5.3 | Oct 22 | Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122 Affected: 0.0.0 before 2.0.3 |
| CVE-2026-84920 New | 5.3 | Oct 22 | Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132 Affected: 0.0.0 before 1.8.0 |
| CVE-2026-84921 New | 5.3 | Oct 22 | Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133 Affected: 0.0.0 before 1.2.0 |
| CVE-2026-87950 New | 5.3 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96366 New | 5.3 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96364 New | 5.3 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96356 New | 5.3 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96377 New | 5.3 | Oct 22 | Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188 Affected: 0.0.0 before 1.0.7 |
| CVE-2026-73478 | 5.3 | Sep 2 | Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096 Affected: 0.0.0 before 2.0.1; 2.1.0 before 2.1.1 |
| CVE-2026-73474 | 5.3 | Sep 2 | Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097 Affected: 0.0.0 before 1.1.2 |
| CVE-2026-73477 | 5.3 | Sep 2 | Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099 Affected: 0.0.0 before 4.3.1 |
| CVE-2026-81165 | 5.3 | Sep 2 | Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104 Affected: 0.0.0 before 3.0.18 |
| CVE-2026-81269 | 5.3 | Sep 2 | Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108 Affected: 0.0.0 before 2.0.13 |
| CVE-2026-81166 | 5.3 | Sep 2 | Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109 Affected: 0.0.0 before 2.6.1 |
| CVE-2026-81162 | 5.3 | Sep 2 | DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112 Affected: 0.0.0 before 2.8.1 |
| CVE-2026-81158 | 5.3 | Sep 2 | Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113 Affected: 0.0.0 before 1.8.0 |
| CVE-2026-81205 | 5.3 | Sep 2 | LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115 Affected: 0.0.0 before 2.2.1 |
| CVE-2026-3526 | 5.3 | Mar 26 | File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021 Affected: 0.0.0 before 1.2.0 |
| CVE-2026-3525 | 5.3 | Mar 26 | File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020 Affected: 0.0.0 before 1.2.0 |
| CVE-2026-3210 | 5.3 | Mar 25 | Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011 Affected: 0.0.0 before 2.0.4 |
| CVE-2026-0944 | 5.3 | Feb 4 | Group invite - Moderately critical - Access bypass - SA-CONTRIB-2026-001 Affected: 0.0.0 before 2.3.9; 3.0.0 before 3.0.4; 4.0.0 before 4.0.4 |
| CVE-2025-13985 | 5.3 | Jan 28 | Entity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123 Affected: 0.0.0 before 3.13.0 |
| CVE-2025-13980 | 5.3 | Jan 28 | CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118 Affected: 0.0.0 before 1.2.10; 1.3.0 before 1.3.6; 1.4.0 before 1.4.3; 1.5.0 before 1.5.1; 1.6.0 before 1.6.4 |
| CVE-2025-13080 | 5.3 | Nov 18 | Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005 Affected: 8.0.0 before 10.4.9; 10.5.0 before 10.5.6; 11.0.0 before 11.1.9; 11.2.0 before 11.2.8 |
| CVE-2025-10929 | 5.3 | Oct 29 | Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111 Affected: 0.0.0 before 1.1.2 |
| CVE-2025-9554 | 5.3 | Oct 10 | Owl Carousel 2 - Critical - Unsupported - SA-CONTRIB-2025-104 Affected: *.* |
The 500 most important CVEs for this product (exploited first, then by severity)