DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
586
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 39High 81Medium 286Low 32
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-9553 | 5.3 | Oct 10 | API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103 Affected: *.* |
| CVE-2025-9552 | 5.3 | Oct 10 | Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102 Affected: *.* |
| CVE-2024-13312 | 5.3 | Jan 9 | Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076 Affected: 11.8.0 before 12.3.10; 12.4.0 before 12.4.9 |
| CVE-2024-13303 | 5.3 | Jan 9 | Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069 Affected: 0.0.0 before 2.0.2 |
| CVE-2024-13302 | 5.3 | Jan 9 | Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068 Affected: 2.0.0 before 2.0.3 |
| CVE-2024-13290 | 5.3 | Jan 9 | OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056 Affected: 0.0.0 before 2.0.4 |
| CVE-2024-13275 | 5.3 | Jan 9 | Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039 Affected: 0.0.0 before 2.0.3 |
| CVE-2024-13274 | 5.3 | Jan 9 | Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038 Affected: 0.0.0 before 12.3.8; 12.4.0 before 12.4.5 |
| CVE-2024-13269 | 5.3 | Jan 9 | Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033 Affected: 0.0.0 before 4.0.11 |
| CVE-2024-13266 | 5.3 | Jan 9 | Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030 Affected: 0.0.0 before 4.4.4 |
| CVE-2024-13257 | 5.3 | Jan 9 | Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021 Affected: 0.0.0 before 1.0.3 |
| CVE-2024-13246 | 5.3 | Jan 9 | Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010 Affected: 0.0.0 before 2.0.2 |
| CVE-2024-45440 | 5.3 | Aug 29 | core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist Affected: 2023-05-09 |
| CVE-2020-13667 | 5.3 | May 17 | Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions Affected: 8.8.0 before 8.8.10; 8.9.0 before 8.9.6; 9.0.0 before 9.0.6 |
| CVE-2017-6928 | 5.3 | Mar 1 | Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or… Affected: 7.0 before 7.57 |
| CVE-2016-6212 | 5.3 | Sep 9 | The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2016-3170 | 5.3 | Apr 12 | The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2026-3216 | 5.0 | Mar 25 | Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017 Affected: 0.0.0 before 1.1.1 |
| CVE-2026-87944 New | 4.8 | Oct 22 | SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-87946 New | 4.8 | Oct 22 | SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-87947 New | 4.8 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96375 New | 4.8 | Oct 22 | Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176 Affected: 0.0.0 before 7.0.1 |
| CVE-2026-18986 | 4.8 | Sep 2 | Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094 Affected: 0.0.0 before 2.16.0 |
| CVE-2026-81167 | 4.8 | Sep 2 | Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103 Affected: 0.0.0 before 1.0.25 |
| CVE-2026-13243 | 4.8 | Jul 10 | Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063 Affected: 0.0.0 before 5.1.3 |
| CVE-2026-13238 | 4.8 | Jul 10 | Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058 Affected: 0.0.0 before 3.0.2 |
| CVE-2026-13237 | 4.8 | Jul 10 | AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057 Affected: 0.0.0 before 1.1.4; 1.2.0 before 1.2.5; 1.3.0 before 1.3.1 |
| CVE-2026-3218 | 4.8 | Mar 25 | Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019 Affected: 0.0.0 before 2.0.2 |
| CVE-2026-1553 | 4.8 | Feb 4 | Drupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-006 Affected: 0.0.0 before 1.0.4 |
| CVE-2026-0947 | 4.8 | Feb 4 | AT Internet Piano Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-004 Affected: 0.0.0 before 1.0.1; 2.0.0 before 2.3.1 |
| CVE-2025-14557 | 4.8 | Jan 14 | XSS in Drupal 7 Facebook Pixel Module Affected: 7.x-1.0 through 7.x-1.1 |
| CVE-2024-13305 | 4.8 | Jan 9 | Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071 Affected: 0.0.0 before 1.1.4 |
| CVE-2024-13298 | 4.8 | Jan 9 | Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064 Affected: 2.0.0 before 2.0.5 |
| CVE-2024-13292 | 4.8 | Jan 9 | Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058 Affected: 0.0.0 before 1.1.2 |
| CVE-2024-13262 | 4.8 | Jan 9 | View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026 Affected: 0.0.0 before 6.0.4 |
| CVE-2024-13247 | 4.8 | Jan 9 | Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011 Affected: 0.0.0 before 1.4.0 |
| CVE-2010-2472 | 4.8 | Nov 7 | Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language… Affected: 5.0 before 5.22; 6.0 before 6.16 |
| CVE-2026-15917 | 4.7 | Aug 25 | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011 Affected: 11.3.0 before 11.3.14; 11.4.0 before 11.4.4; 0.0.0 before 11.2.* |
| CVE-2026-3213 | 4.7 | Mar 25 | Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014 Affected: 0.0.0 before 9.7.0 |
| CVE-2017-6932 | 4.7 | Mar 1 | Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used Affected: 7.0 before 7.57 |
| CVE-2026-84912 New | 4.6 | Oct 22 | AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120 Affected: 0.0.0 before 1.3.13; 1.4.0 before 1.4.8 |
| CVE-2026-84913 New | 4.6 | Oct 22 | AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121 Affected: 0.0.0 before 1.3.2; 1.4.0 before 1.4.1 |
| CVE-2026-84915 New | 4.6 | Oct 22 | Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123 Affected: 0.0.0 before 1.2.7 |
| CVE-2026-84919 New | 4.6 | Oct 22 | PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131 Affected: 0.0.0 before 5.0.9 |
| CVE-2026-87942 New | 4.6 | Oct 22 | SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140 Affected: 0.0.0 before 1.0.88 |
| CVE-2026-96361 New | 4.6 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96358 New | 4.6 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96359 New | 4.6 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96367 New | 4.6 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96368 New | 4.6 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
The 500 most important CVEs for this product (exploited first, then by severity)