DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
545
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 39High 72Medium 256Low 30
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-11023 In wildKEV | 6.1 | Apr 29 | Potential XSS vulnerability in jQuery Affected: 7.0 before 7.70; 8.7.0 before 8.7.14; 8.8.0 before 8.8.6 |
| CVE-2024-13268 | 6.8 | Jan 9 | Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032 Affected: 7.x-1.0 before 7.x-1.23 |
| CVE-2016-9451 | 6.8 | Nov 25 | Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2026-6366 | 6.6 | May 19 | Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002 Affected: 8.0.0 before 10.5.9; 10.6.0 before 10.6.7; 11.0.0 before 11.2.11; 11.3.0 before 11.3.7 |
| CVE-2024-13300 | 6.6 | Jan 9 | Print Anything - Critical - Unsupported - SA-CONTRIB-2024-066 Affected: *.* |
| CVE-2024-13299 | 6.6 | Jan 9 | Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065 Affected: *.* |
| CVE-2024-13297 | 6.6 | Jan 9 | Eloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-063 Affected: 7.x-* before 7.x-1.15 |
| CVE-2024-13296 | 6.6 | Jan 9 | Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062 Affected: 0.0.0 before 4.0.1 |
| CVE-2024-13295 | 6.6 | Jan 9 | Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061 Affected: 7.x-* before 7.x-3.3 |
| CVE-2026-84923 New | 6.5 | Oct 22 | Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124 Affected: 0.0.0 before 2.4.0 |
| CVE-2026-84917 New | 6.5 | Oct 22 | Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127 Affected: 0.0.0 before 2.0.2 |
| CVE-2026-87936 New | 6.5 | Oct 22 | amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134 Affected: 0.0.0 before 1.3.7; 1.4.0 before 1.4.3 |
| CVE-2026-87937 New | 6.5 | Oct 22 | Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135 Affected: 0.0.0 before 2.0.4; 2.1.0 before 2.1.3 |
| CVE-2026-87943 New | 6.5 | Oct 22 | SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96385 New | 6.5 | Oct 22 | REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96380 New | 6.5 | Oct 22 | CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189 Affected: 1.0.0 before 1.0.2 |
| CVE-2026-96386 New | 6.5 | Oct 22 | Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190 Affected: 0.0.0 before 3.2.1 |
| CVE-2026-13242 | 6.5 | Jul 10 | Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062 Affected: 0.0.0 before 3.15.0 |
| CVE-2026-13241 | 6.5 | Jul 10 | Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061 Affected: 0.0.0 before 1.21.0 |
| CVE-2026-13240 | 6.5 | Jul 10 | Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060 Affected: 0.0.0 before 1.21.0 |
| CVE-2026-13239 | 6.5 | Jul 10 | WissKI - Critical - Access bypass - SA-CONTRIB-2026-059 Affected: 0.0.0 before 4.2.0 |
| CVE-2026-1556 | 6.5 | Mar 26 | Information disclosure via file URI overwrite in File (Field) Paths Affected: 7.x-1.0 before 7.x-1.3 |
| CVE-2026-3531 | 6.5 | Mar 26 | OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026 Affected: 0.0.0 before 1.5.0 |
| CVE-2026-3527 | 6.5 | Mar 26 | AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022 Affected: 0.0.0 before 3.1.0 |
| CVE-2026-3214 | 6.5 | Mar 25 | CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015 Affected: 0.0.0 before 1.17.0; 2.0.0 before 2.0.10 |
| CVE-2024-13310 | 6.5 | Jan 9 | Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074 Affected: *.* |
| CVE-2024-13243 | 6.5 | Jan 9 | Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007 Affected: 0.0.0 before 1.1.1 |
| CVE-2023-31250 | 6.5 | Apr 26 | The file download facility doesn't sufficiently sanitize file paths in certain situations Affected: 7.0 before 7.96; 9.4 before 9.4.14; 9.5 before 9.5.8; 10.0 before 10.0.8 |
| CVE-2022-25278 | 6.5 | Apr 26 | Under certain circumstances, the Drupal core form API evaluates form element access incorrectly Affected: 8.0.0 before 9.3.19; 9.4.0 before 9.4.3 |
| CVE-2022-25270 | 6.5 | Feb 17 | The Quick Edit module does not properly check entity access in some circumstances Affected: 9.2.0 before 9.2.13; 9.3.0 before 9.3.6 |
| CVE-2020-13676 | 6.5 | Feb 11 | The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data Affected: 8.9.0 before 8.9.19; 9.1.0 before 9.1.13; 9.2.0 before 9.2.6 |
| CVE-2020-13674 | 6.5 | Feb 11 | The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues Affected: 8.9.0 before 8.9.19; 9.1.0 before 9.1.13; 9.2.0 before 9.2.6 |
| CVE-2010-2473 | 6.5 | Nov 7 | Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances Affected: 5.0 before 5.22; 6.0 before 6.16 |
| CVE-2017-6923 | 6.5 | Jan 22 | Access bypass in Drupal 8 views Affected: 8.x before 8.3.7 |
| CVE-2017-6922 | 6.5 | Jan 22 | Files uploaded by anonymous users into a private file system can be accessed by other anonymous users Affected: Drupal 8 before 8.3.3; Drupal 7 before 7.55 |
| CVE-2018-14773 | 6.5 | Aug 3 | An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0… Affected: 8.0.0 before 8.5.6 |
| CVE-2017-6931 | 6.5 | Mar 1 | In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for Affected: 8.4.0 before 8.4.5 |
| CVE-2016-9452 | 6.5 | Nov 25 | The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2026-96376 New | 6.4 | Oct 22 | Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177 Affected: 0.0.0 before 7.0.1 |
| CVE-2016-3168 | 6.4 | Apr 12 | The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2024-13272 | 6.3 | Jan 9 | Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036 Affected: 0.0.0 before 1.23.0; 2.0.0 before 2.0.2 |
| CVE-2026-81201 | 6.1 | Sep 2 | Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116 Affected: 0.0.0 before 9.5.3 |
| CVE-2026-81160 | 6.1 | Sep 2 | Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117 Affected: 0.0.0 before 2.1.0 |
| CVE-2026-16638 | 6.1 | Aug 25 | Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080 Affected: 0.0.0 before 1.0.8 |
| CVE-2026-16640 | 6.1 | Aug 25 | Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082 Affected: 0.0.0 before 1.12.0 |
| CVE-2026-58588 | 6.1 | Jul 10 | Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066 Affected: 0.0.0 before 1.4.2; 1.5.0 before 1.5.2; 1.6.0 before 1.6.1; 1.7.0 before 1.7.1 |
| CVE-2026-58587 | 6.1 | Jul 10 | Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065 Affected: 0.0.0 before 1.4.2; 1.5.0 before 1.5.2; 1.6.0 before 1.6.1; 1.7.0 before 1.7.1 |
| CVE-2026-13234 | 6.1 | Jul 10 | AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054 Affected: 0.0.0 before 1.2.17; 1.3.0 before 1.3.8; 1.4.0 before 1.4.3 |
| CVE-2026-13231 | 6.1 | Jul 10 | Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051 Affected: 0.0.0 before 2.8.0 |
| CVE-2026-10770 | 6.1 | Jul 10 | Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042 Affected: 0.0.0 before 9.7.1 |
The 500 most important CVEs for this product (exploited first, then by severity)