drupal/core vulnerabilities (Packagist)
151 vulnerabilities.
-
drupal/corePackagist Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016 6.5 Medium -
drupal/corePackagist Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015 6.5 Medium -
drupal/corePackagist Drupal core - Critical - Remote code execution - SA-CORE-2026-014 8.1 High -
drupal/corePackagist The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal. Vulnerabilities are possible if Drupal is configured to use CKEditor for… No score -
drupal/corePackagist Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012 5.4 Medium -
drupal/corePackagist Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011 4.7 Medium -
drupal/corePackagist Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010 4.2 Medium -
drupal/corePackagist Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009 5.4 Medium -
drupal/corePackagist Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008 3.1 Low -
drupal/corePackagist Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007 5.9 Medium -
drupal/corePackagist Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006 5.9 Medium -
drupal/corePackagist Drupal core - Critical - PHP object injection - SA-CORE-2026-005 5.9 Medium -
drupal/corePackagist Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003 6.1 Medium -
drupal/corePackagist Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008 3.7 Low -
drupal/corePackagist Drupal core - Moderately critical - Defacement - SA-CORE-2025-007 4.3 Medium -
drupal/corePackagist Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006 5.9 Medium -
drupal/corePackagist Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002 5.9 Medium -
drupal/corePackagist Drupal core Cross-Site Scripting (XSS) vulnerabilities 5.3 Medium -
drupal/corePackagist Drupal core Arbitrary PHP code execution 7.8 High -
drupal/corePackagist Drupal core Open Redirect vulnerability 4.3 Medium -
drupal/corePackagist Drupal core uses a vulnerable Third-party library CKEditor 4.2 Medium -
drupal/corePackagist Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar 8.1 High -
drupal/corePackagist Drupal core Access bypass 4.3 Medium -
drupal/corePackagist Drupal core unrestricted file upload 6.6 Medium -
drupal/corePackagist Drupal core Denial of Service 5.3 Medium -
drupal/corePackagist Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution No score -
drupal/corePackagist Drupal core Remote Code Execution No score -
drupal/corePackagist Drupal Anonymous Open Redirect 5.8 Medium -
drupal/corePackagist Drupal External URL injection through URL aliases leading to Open Redirect No score -
drupal/corePackagist Drupal Content moderation Access bypass No score -
drupal/corePackagist Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 9.8 Critical -
drupal/corePackagist Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002 6.6 Medium -
drupal/corePackagist Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001 6.1 Medium -
drupal/corePackagist Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004 5.4 Medium -
drupal/corePackagist Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003 7.5 High -
drupal/corePackagist Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002 4.6 Medium -
drupal/corePackagist Drupal core - Critical - Cross site scripting - SA-CORE-2025-001 6.1 Medium -
drupal/corePackagist Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005 5.3 Medium -
drupal/corePackagist Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008 9.8 Critical -
drupal/corePackagist Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007 9.8 Critical -
drupal/corePackagist Drupal core - Less critical - Gadget chain - SA-CORE-2024-006 9.8 Critical -
drupal/corePackagist Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004 8.1 High -
drupal/corePackagist Drupal core Denial of Service vulnerability 5.3 Medium -
drupal/corePackagist Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003 5.4 Medium -
drupal/corePackagist Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001 7.5 High -
drupal/corePackagist Drupal Denial of Service vulnerability 7.5 High -
drupal/corePackagist Drupal core - Critical - Cache poisoning - SA-CORE-2023-006 7.5 High -
drupal/corePackagist Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005 6.5 Medium -
drupal/corePackagist Drupal core provides a page that outputs the markup from phpinfo() to assist with diagnosing PHP configuration. If an attacker was able to achieve an XSS exploit against a privileged user, they may be… No score -
drupal/corePackagist The language module provides a Language switcher block which can be placed to provide links to quickly switch between different languages. The URL of unpublished translations may be disclosed. When us… No score - Show olderLoading…