Skip to contentDrupal vulnerabilities
Products
Show 46 moreShow less
Newest
- drupal wiki, kontextwork drupal wiki +1 moredrupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of...CVE-2024-344816.1 Medium
- acquia dam, drupal acquia dam +1 moreAcquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025CVE-2024-13261Fix available3.5 Low
- drupal migrate queue importer, migrate queue importer project queue importer +1 moreMigrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024CVE-2024-13260Fix available8.8 High
- drupal image sizes, image sizes project sizes +1 moreImage Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023CVE-2024-13259Fix available7.5 High
- drupal rest & json api authentication, rest \& json api authentication project \& json api authentication +1 moreDrupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022CVE-2024-13258Fix available9.8 Critical
- commerce view receipt project view receipt, drupal commerce view receipt +1 moreCommerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021CVE-2024-13257Fix available5.3 Medium
- drupal email contact, email contact project contact +1 moreEmail Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020CVE-2024-13256Fix available7.5 High
- drupal rest views, rest views project views +1 moreREST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018CVE-2024-13254Fix available7.5 High
- advanced pwa inc push notifications project pwa inc push notifications, drupal advanced pwa inc push notifications +1 moreAdvanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017CVE-2024-13253Fix available9.1 Critical
- drupal tacjsTacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016CVE-2024-13252Fix available5.4 Medium
- drupal registration role, registration role project role +1 moreRegistration role - Critical - Access bypass - SA-CONTRIB-2024-015CVE-2024-13251Fix available8.8 High
- drupal symfony mailer liteDrupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014CVE-2024-13250Fix available8.8 High
- drupal private content, private content project content +1 morePrivate content - Moderately critical - Access bypass - SA-CONTRIB-2024-012CVE-2024-13248Fix available5.5 Medium
- coffee project coffeeCoffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011CVE-2024-13247Fix available4.8 Medium
- drupal node access rebuild progressive, node access rebuild progressive project access rebuild progressive +1 moreNode Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010CVE-2024-13246Fix available5.3 Medium
- cksource ckeditor 4, drupal ckeditor 4 lts - wysiwyg html editor +1 moreCKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009CVE-2024-13245Fix available5.4 Medium
- drupal core, drupal +1 moreDrupal core - Highly critical - SQL injection - SA-CORE-2026-004CVE-2026-9082In KEVPublic exploitFix availableEPSS 89.4%9.8 Critical
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002CVE-2026-6366Fix available6.6 Medium
- drupal, drupal core +1 moreDrupal core - Critical - Cross-site scripting - SA-CORE-2026-001CVE-2026-6365Fix available6.1 Medium
- drupal, drupal core, link +2 moreDrupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004CVE-2025-31675Fix available5.4 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003CVE-2025-31674Fix available7.5 High
- drupal, drupal core +1 moreDrupal core - Moderately critical - Access bypass - SA-CORE-2025-002CVE-2025-31673Fix available4.6 Medium
- drupal, drupal core +1 moreDrupal core - Critical - Cross site scripting - SA-CORE-2025-001CVE-2025-3057Fix available6.1 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Denial of Service - SA-CORE-2025-005CVE-2025-13080Fix available5.3 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget chain - SA-CORE-2024-008CVE-2024-55638Fix available9.8 Critical
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget chain - SA-CORE-2024-007CVE-2024-55637Fix available9.8 Critical
- drupal, drupal core +1 moreDrupal core - Less critical - Gadget chain - SA-CORE-2024-006CVE-2024-55636Fix available9.8 Critical
- drupal, drupal core +1 moreDrupal core - Moderately critical - Access bypass - SA-CORE-2024-004CVE-2024-55634Fix available8.1 High
- drupal, drupal core +1 moreDrupal core Denial of Service vulnerabilityCVE-2024-45440Public exploitFix available5.3 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003CVE-2024-12393Fix available5.4 Medium
- drupal migrate tools, migrate tools project tools +1 moreMigrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008CVE-2024-13244Fix available8.8 High
- drupal entity delete log, entity delete log project delete log +1 moreEntity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007CVE-2024-13243Fix available6.5 Medium
- swift mailer project mailer, drupal swift mailer (abandoned) +1 moreSwift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006CVE-2024-132429.1 Critical
- drupal open socialOpen Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005CVE-2024-132419.1 Critical
- drupal open socialOpen Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004CVE-2024-132407.5 High
- drupal two-factor authentication (tfa), two-factor authentication project authentication +1 moreTwo-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003CVE-2024-13239Fix available9.8 Critical
- drupal, drupal core +1 moreDrupal core - Moderately critical - Denial of Service - SA-CORE-2024-001CVE-2024-11941Fix available7.5 High
- drupalDrupal Denial of Service vulnerabilityCVE-2024-22362Fix available7.5 High
- drupal typogrifyTypogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002CVE-2024-13238Fix available5.4 Medium
- drupal core, drupal +1 moreDrupal core - Critical - Cache poisoning - SA-CORE-2023-006CVE-2023-5256Fix available7.5 High
- drupal responsive menusResponsive Menus Configuration Setting responsive_menus.module responsive_menus_admin_form_submit cross site scriptingCVE-2018-250852.4 Low
- drupal core, drupal +1 moreDrupal core - Moderately critical - Access bypass - SA-CORE-2023-005CVE-2023-31250Fix available6.5 Medium
- symfony twig, debian linux, drupal +1 more +3 moreTwig may load a template outside a configured directory when using the filesystem loaderCVE-2022-39261Fix available7.5 High
- drupal core, drupal +1 moreLack of domain validation in Druple coreCVE-2022-25276Fix available6.1 Medium
- drupal core, drupal +1 moreDrupal core arbitrary PHP code executionCVE-2022-25277Fix available7.2 High
- drupal core, drupal +1 moreDrupal core Denial of Service vulnerabilityCVE-2022-25278Fix available6.5 Medium
- drupal core, drupal +1 moreDrupal core Denial of Service vulnerabilityCVE-2022-25275Fix available7.5 High
- jqueryui jquery ui, debian linux, drupal jquery ui checkboxradio +8 more +10 morejQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text labelCVE-2022-31160Public exploitFix available6.1 Medium
- guzzle, debian linux, drupal +2 moreFix failure to strip Authorization header on HTTP downgrade in GuzzleCVE-2022-31043Fix available7.5 High
- guzzle, debian linux, drupal +2 moreFailure to strip the Cookie header on change in host or HTTP downgrade in GuzzleCVE-2022-31042Fix available7.5 High
- Show moreLoading…