DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
545
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 39High 73Medium 262Low 30
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-7572 | 4.3 | Oct 3 | The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended… Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2016-7570 | 4.3 | Oct 3 | Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary… Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2026-84910 New | 4.2 | Oct 22 | Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118 Affected: 0.0.0 before 2.4.5 |
| CVE-2026-87939 New | 4.2 | Oct 22 | Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137 Affected: 0.0.0 before 2.0.2; 3.0.0 before 3.0.2 |
| CVE-2026-96362 New | 4.2 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96374 New | 4.2 | Oct 22 | Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178 Affected: 0.0.0 before 2.0.3; 2.1.0 before 2.1.5 |
| CVE-2026-15916 | 4.2 | Aug 25 | Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010 Affected: 0.0.0 before 10.6.13; 11.3.0 before 11.3.14; 11.4.0 before 11.4.4; 0.0.0 before 11.0.*; 0.0.0 before 11.1.*; 0.0.0 before 11.2.* |
| CVE-2026-15083 | 4.2 | Jul 10 | ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074 Affected: 0.0.0 before 2.1.20; 3.0.0 before 3.0.12; 3.1.0 before 3.1.4 |
| CVE-2026-13236 | 4.2 | Jul 10 | AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056 Affected: 0.0.0 before 1.1.4; 1.2.0 before 1.2.5; 1.3.0 before 1.3.1 |
| CVE-2026-3532 | 4.2 | Mar 26 | OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027 Affected: 0.0.0 before 1.5.0 |
| CVE-2026-1554 | 4.2 | Feb 4 | Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007 Affected: 0.0.0 before 2.0.3; 2.1.0 before 2.1.2 |
| CVE-2026-16647 | 4.1 | Sep 2 | Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111 Affected: 0.0.0 before 1.1.4 |
The 500 most important CVEs for this product (exploited first, then by severity)