Skip to contentDrupal vulnerabilities
Products
Show 46 moreShow less
Newest
- drupal, drupal core +1 moreDrupal core - Critical - Access bypass - SA-CORE-2019-008CVE-2019-6342Fix available9.8 Critical
- prestashop, drupal +1 morePrestaShop Cross-site Scripting vulnerabilityCVE-2019-11876Fix available6.1 Medium
- typo3 pharstreamwrapper, debian linux, drupal +2 more +4 moreDirectory Traversal in typo3/phar-stream-wrapperCVE-2019-11831Fix available9.8 Critical
- sensiolabs symfony, drupal +1 moreImproper authentication in SymfonyCVE-2019-10911Fix available7.5 High
- sensiolabs symfony, drupal +1 moreSymfony Service IDs Allow InjectionCVE-2019-10910Fix available9.8 Critical
- sensiolabs symfony, drupal +1 moreSymfony Cross-site Scripting (XSS) vulnerabilityCVE-2019-10909Public exploitFix available5.4 Medium
- backdropcms backdrop, drupal, jquery +102 more +104 moreXSS in jQuery as used in Drupal, Backdrop CMS, and other productsCVE-2019-11358Public exploitFix availableEPSS 86.8%6.1 Medium
- drupal, drupal core, debian linux +1 more +3 moreDrupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004CVE-2019-6341Fix availableEPSS 12.2%5.4 Medium
- drupal core, drupal +1 moreDrupal core - Highly critical - Remote Code ExecutionCVE-2019-6340In KEVPublic exploitFix availableEPSS 92.0%8.1 High
- drupal, drupal core +1 moreAccess bypass in Drupal 8 viewsCVE-2017-6923Fix available6.5 Medium
- drupal, drupal core, debian linux +2 morePHAR stream wrapper Arbitrary PHP code executionCVE-2019-6339Public exploitFix availableEPSS 35.9%9.8 Critical
- drupal, drupal core, debian linux +2 morethird-party PEAR Archive_Tar library updatesCVE-2019-6338Fix available8.0 High
- search autocomplete project autocomplete, drupal 3rd party module - search autocomplete +1 moreSearch AutocompleteCVE-2018-76036.1 Medium
- drupal, drupal core +1 moreFile REST resource does not properly validateCVE-2017-6921Fix available5.9 Medium
- drupal, drupal core +1 moreREST API can bypass comment approval - Access Bypass - Moderately CriticalCVE-2017-6924Fix available7.4 High
- drupalDrupal Entity access bypass for entities that do not have UUIDs or have protected revisionsCVE-2017-6925Fix available9.8 Critical
- drupal, drupal core, drupal.org drupal core +2 moreDrupal PECL YAML parser unsafe object handlingCVE-2017-6920Fix availableEPSS 20.2%9.8 Critical
- sensiolabs symfony, debian linux, drupal +2 moreSymfony HTTP Foundation web cache poisoningCVE-2018-14773Fix availableEPSS 57.6%6.5 Medium
- drupal core, drupal, debian linux +2 moreDrupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004CVE-2018-7602In KEVPublic exploitFix availableEPSS 99.2%9.8 Critical
- ckeditor enhanced image, drupal +1 moreEnhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)CVE-2018-9861Fix available6.1 Medium
- avatar uploader uploader, drupal avatar uploader +1 moreVulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or...CVE-2018-9205Public exploitEPSS 55.1%7.5 High
- drupal storage apiThe Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute...CVE-2014-51709.8 Critical
- drupal, drupal core, debian linux +2 moreDrupal Core Remote Code Execution VulnerabilityCVE-2018-7600In KEVPublic exploitFix availableEPSS 100.0%9.8 Critical
- drupal, drupal core, drupal.org drupal core +2 moreDrupal Settings Tray access bypassCVE-2017-6931Fix available6.5 Medium
- drupal, drupal core, drupal.org drupal core +2 moreDrupal access bypass vulnerabilityCVE-2017-6930Fix available8.1 High
- drupal, drupal core, drupal.org drupal core +2 moreDrupal Comment reply form allows access to restricted contentCVE-2017-6926Fix available8.1 High
- drupal, drupal core, drupal.org drupal core +1 more +3 moreDrupal external link injection vulnerabilityCVE-2017-6932Fix available4.7 Medium
- drupal, drupal core, drupal.org drupal core +1 more +3 moreDrupal cross site scripting vulnerabilityCVE-2017-6929Fix available6.1 Medium
- drupal, drupal core, drupal.org drupal core +1 more +3 moreDrupal access bypass vulnerabilityCVE-2017-6928Fix available5.3 Medium
- drupal, debian linux, drupal core +1 more +3 moreDrupal cross-site scripting vulnerabilityCVE-2017-6927Fix available6.1 Medium
- drupalThe Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to...CVE-2015-78804.3 Medium
- drupal, drupal core, debian linux +2 moreFiles uploaded by anonymous users into a private file system can be accessed by other anonymous usersCVE-2017-6922Fix available6.5 Medium
- bestweblayout portfolio, bestwebsoft captcha, car rental +51 more +53 moreCross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version...CVE-2017-21716.1 Medium
- drupalDrupal access control bypass vulnerabilityCVE-2017-6919Fix available7.5 High
- drupal, drupal core +1 moreDrupal Remote code executionCVE-2017-6381Fix available8.1 High
- drupal, drupal core +1 moreDrupal Cross-Site Request Forgery (CSRF)CVE-2017-6379Fix available7.5 High
- drupal, drupal core +1 moreDrupal editor module incorrectly checks access to inline private filesCVE-2017-6377Fix available7.5 High
- drupalDrupal Denial of service via transliterate mechanismCVE-2016-9452Fix available6.5 Medium
- drupalDrupal Incorrect cache context on password reset pageCVE-2016-9450Fix available7.5 High
- drupalDrupal Open RedirectCVE-2016-9451Fix available6.8 Medium
- drupalDrupal sensitive information disclosureCVE-2016-9449Fix available4.3 Medium
- drupalDrupal Unprivileged access to config exportCVE-2016-7572Fix available4.3 Medium
- drupalDrupal Cross-site scripting (XSS) vulnerabilityCVE-2016-7571Fix available6.1 Medium
- drupalDrupal Users without "Administer comments" can set comment visibility on nodes they can editCVE-2016-7570Fix available4.3 Medium
- drupalDrupal Views can allow unauthorized users to see Statistics informationCVE-2016-6212Fix available5.3 Medium
- php, debian linux, drupal +9 more +11 moreHTTP Proxy header vulnerabilityCVE-2016-5385Fix availableEPSS 50.4%8.1 High
- drupal, debian linux +1 moreDrupal Saving user accounts can sometimes grant the user all rolesCVE-2016-6211Fix available8.8 High
- drupal, debian linux +1 moreDrupal arbitrary code executionCVE-2016-3171Fix available8.1 High
- drupal, debian linux +1 moreDrupal Open redirect vulnerability in the drupal_goto functionCVE-2016-3167Fix available7.4 High
- drupal, debian linux +1 moreDrupal CRLF injection vulnerability in the drupal_set_header functionCVE-2016-3166Fix available5.9 Medium
- Show moreLoading…