drupal/core

Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

Affected: from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8; from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8; from 7.0, fixed in 7.103.

Drupal core - Moderately critical - Defacement - SA-CORE-2025-007

Affected: from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8; from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8.

Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006

Affected: from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8; from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8.

Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005

Affected: from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8; from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8.

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Affected: from 8.0.0, fixed in 10.3.14; from 10.4.0, fixed in 10.4.5; from 11.0.0, fixed in 11.0.13; from 11.1.0, fixed in 11.1.5; from 8.0.0, fixed in 10.3.14; from 10.4.0, fixed in 10.4.5; from 11.0.0, fixed in 11.0.13; from 11.1.0, fixed in 11.1.5.

Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Affected: from 8.0.0, fixed in 10.3.13; from 10.4.0, fixed in 10.4.3; from 11.0.0, fixed in 11.0.12; from 11.1.0, fixed in 11.1.3; from 8.0.0, fixed in 10.3.13; from 10.4.0, fixed in 10.4.3; from 11.0.0, fixed in 11.0.12; from 11.1.0, fixed in 11.1.3.

Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

Affected: from 8.0.0, fixed in 10.3.13; from 10.4.0, fixed in 10.4.3; from 11.0.0, fixed in 11.0.12; from 11.1.0, fixed in 11.1.3; from 8.0.0, fixed in 10.3.13; from 10.4.0, fixed in 10.4.3; from 11.0.0, fixed in 11.0.12; from 11.1.0, fixed in 11.1.3.

Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

Affected: from 8.0.0, fixed in 10.3.13; from 10.4.0, fixed in 10.4.3; from 11.0.0, fixed in 11.0.12; from 11.1.0, fixed in 11.1.3; from 8.0.0, fixed in 10.3.13; from 10.4.0, fixed in 10.4.3; from 11.0.0, fixed in 11.0.12; from 11.1.0, fixed in 11.1.3.

Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008

Affected: from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 7.0, fixed in 7.102; from 8.0.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9.

Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007

Affected: from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8; from 8.0.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

Drupal core - Less critical - Gadget chain - SA-CORE-2024-006

Affected: from 8.0.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8; from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004

Affected: from 8.0.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8; from 8.0.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003

Affected: from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8; from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002

Affected: from 10.0.0, fixed in 10.2.10.

Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001

Affected: from 8.0.0, fixed in 10.1.8; from 10.2.0, fixed in 10.2.2; from 10.1.0, fixed in 10.1.8; from 10.2.0, fixed in 10.2.2.

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is…

Affected: from 10.3.0, fixed in 10.3.6; from 11.0.0, fixed in 11.0.5; from 8.0.0, fixed in 10.2.9.

Drupal contains a vulnerability with improper handling of structural elements.

Affected: versions 9.3.6.

Drupal core - Critical - Cache poisoning - SA-CORE-2023-006

Affected: from 8.7.0, fixed in 9.5.11; from 10.0.0, fixed in 10.0.11; from 10.1.0, fixed in 10.1.4; from 8.7.0, fixed in 9.5.11; from 10.0.0, fixed in 10.0.11; from 10.1.0, fixed in 10.1.4.

Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005

Affected: from 8.0.0, fixed in 9.4.14; from 9.5.0, fixed in 9.5.8; from 10.0.0, fixed in 10.0.8; from 10.0.0, fixed in 10.0.8; from 9.5.0, fixed in 9.5.8; from 9.0.0, fixed in 9.4.14; from 7.0.0, fixed in 7.96.

Under certain circumstances, the Drupal core form API evaluates form element access incorrectly.

Affected: from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3; from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3.

Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots…

Affected: from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3; from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3.

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of…

Affected: from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3; from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3.

In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when…

Affected: from 7.0.0, fixed in 7.91; from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3; from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3.

Drupal 9.3 implemented a generic entity access API for entity revisions.

Affected: from 9.3.0, fixed in 9.3.12.

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input…

Affected: from 8.0.0, fixed in 9.2.18; from 9.3.0, fixed in 9.3.12; from 8.0.0, fixed in 9.2.18; from 9.3.0, fixed in 9.3.12.

Twig may load a template outside a configured directory when using the filesystem loader

Affected: from 8.0.0, fixed in 9.3.22; from 9.4.0, fixed in 9.4.7.

Fix failure to strip Authorization header on HTTP downgrade in Guzzle

Affected: from 8.0.0, fixed in 9.2.21; from 9.3.0, fixed in 9.3.16.

Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle

Affected: from 8.0.0, fixed in 9.2.21; from 9.3.0, fixed in 9.3.16.

Cross-domain cookie leakage in Guzzle

Affected: from 8.0.0, fixed in 9.2.20; from 9.3.0, fixed in 9.3.14.

Improper Input Validation in guzzlehttp/psr7

Affected: from 8.0.0, fixed in 9.2.16; from 9.3.0, fixed in 9.3.9.

Regular expression Denial of Service in dialog plugin

Affected: from 8.0.0, fixed in 9.2.15; from 9.3.0, fixed in 9.3.8.

Cross-site Scripting in CKEditor4

Affected: from 8.0.0, fixed in 9.2.15; from 9.3.0, fixed in 9.3.8.

The Quick Edit module does not properly check entity access in some circumstances.

Affected: from 9.3.0, fixed in 9.3.6; from 8.0.0, fixed in 9.2.13; from 8.0.0, fixed in 9.2.13; from 9.3.0, fixed in 9.3.6.

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input…

Affected: from 8.0.0, fixed in 9.2.13; from 9.3.0, fixed in 9.3.6; from 9.3.0, fixed in 9.3.6; from 8.0.0, fixed in 9.2.13; from 7.0.0, fixed in 7.88.

Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in…

Affected: from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6; from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6.

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data.

Affected: from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6; from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6.

Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent…

Affected: from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6; from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6.

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances…

Affected: from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6; from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6.

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs.

Affected: from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6; from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6.

The Entity Embed module provides a filter to allow embedding entities in content fields.

Affected: from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6.

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain…

Affected: from 7.0.0, fixed in 7.80; from 8.0.0, fixed in 8.9.14; from 9.0.0, fixed in 9.0.12; from 9.1.0, fixed in 9.1.7; from 8.0.0, fixed in 8.9.14; from 9.0.0, fixed in 9.0.12; from 9.1.0, fixed in 9.1.7.

Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS.

Affected: from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6; from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6.

Access bypass in Drupal Core 8/9

Affected: from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6.

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

Affected: from 8.0.0, fixed in 8.9.17; from 9.1.0, fixed in 9.1.11; from 9.2.0, fixed in 9.2.2.

Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in…

Affected: from 8.8.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6; from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6.

Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests…

Affected: from 8.9.0, fixed in 8.9.1; from 9.0.0, fixed in 9.0.1; from 7.0.0, fixed in 7.72; from 8.0.0, fixed in 8.8.8; from 8.0.0, fixed in 8.8.8; from 8.9.0, fixed in 8.9.1; from 9.0.0, fixed in 9.0.1.

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote…

Affected: from 7.0.0, fixed in 7.80; from 8.0.0, fixed in 8.9.16; from 9.0.0, fixed in 9.0.14; from 9.1.0, fixed in 9.1.9; from 8.0.0, fixed in 8.9.16; from 9.0.0, fixed in 9.0.14; from 9.1.0, fixed in 9.1.9.

Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions.

Affected: from 8.8.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6; from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6.

Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances.

Affected: from 8.8.0, fixed in 8.8.8; from 8.9.0, fixed in 8.9.1; from 9.0.0, fixed in 9.0.1; from 8.0.0, fixed in 8.8.8; from 8.9.0, fixed in 8.9.1; from 9.0.0, fixed in 9.0.1.

Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to…

Affected: from 7.0.0, fixed in 7.70.

Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode.

Affected: from 8.8.0, fixed in 8.8.8; from 8.9.0, fixed in 8.9.1; from 9.0.0, fixed in 9.0.1.

Cross-site scripting vulnerability in Drupal Core.

Affected: from 8.8.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6; from 7.0.0, fixed in 7.73; from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6.

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect exten

Affected: from 8.0.0, fixed in 8.8.11; from 8.9.0, fixed in 8.9.9; from 9.0.0, fixed in 9.0.8; from 9.0.0, fixed in 9.0.8; from 8.9.0, fixed in 8.9.9; from 8.0.0, fixed in 8.8.11; from 7.0.0, fixed in 7.74.

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

Affected: from 8.0.0, fixed in 8.8.12; from 8.9.0, fixed in 8.9.10; from 9.0.0, fixed in 9.0.9.

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as fil

Affected: from 8.0.0, fixed in 8.8.12; from 8.9.0, fixed in 8.9.10; from 9.0.0, fixed in 9.0.9.

Drupal core - Critical - Access bypass - SA-CORE-2019-008

Affected: from 8.7.4, fixed in 8.7.5.

An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column…

Affected: versions 6.20.

A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table…

Affected: versions 6.20.

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not…

Affected: from 8.0.0, fixed in 8.5.15; from 8.6.0, fixed in 8.6.15.

The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory…

Affected: from 7.0.0, fixed in 7.67.0; from 8.0.0, fixed in 8.6.16; from 8.7.0, fixed in 8.7.1; from 8.0.0, fixed in 8.6.16; from 8.7.0, fixed in 8.7.1.

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of…

Affected: from 8.0.0, fixed in 8.5.15; from 8.6.0, fixed in 8.6.15.

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004

Affected: from 7.0.0, fixed in 7.65.0; from 8.0.0, fixed in 8.5.14; from 8.6.0, fixed in 8.6.13; from 8.0.0, fixed in 8.5.14; from 8.6.0, fixed in 8.6.13.

Drupal core - Highly critical - Remote Code Execution

Affected: from 8.0.0, fixed in 8.5.11; from 8.6.0, fixed in 8.6.10; from 8.6.0, fixed in 8.6.10; from 7.0.0, fixed in 7.62.0; from 8.0.0, fixed in 8.5.11.

Access bypass in Drupal 8 views

Affected: from 8.0, fixed in 8.3.7.

PHAR stream wrapper Arbitrary PHP code execution

Affected: from 8.0.0, fixed in 8.5.9; from 8.6.0, fixed in 8.6.6; from 7.0.0, fixed in 7.62.0; from 8.0.0, fixed in 8.5.9; from 8.6.0, fixed in 8.6.6.

third-party PEAR Archive_Tar library updates

Affected: from 8.0.0, fixed in 8.5.9; from 8.6.0, fixed in 8.6.6.

Files uploaded by anonymous users into a private file system can be accessed by other anonymous users

Affected: from 7.0, fixed in 7.56; from 8.0, fixed in 8.3.4.

File REST resource does not properly validate

Affected: from 8.0, fixed in 8.3.4.

REST API can bypass comment approval - Access Bypass - Moderately Critical

Affected: from 8.0, fixed in 8.3.7.

In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to…

Affected: from 8.0, fixed in 8.3.7.

Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects…

Affected: from 8.0, fixed in 8.3.4.

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

Affected: from 8.0.0, fixed in 8.4.8; from 8.5.0, fixed in 8.5.3; from 7.0, fixed in 7.59; from 8.0, fixed in 8.4.8; from 8.5, fixed in 8.5.3.

Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed…

Affected: from 8.5.0, fixed in 8.5.2; from 8.0, fixed in 8.4.7; from 8.0.0, fixed in 8.4.7; from 8.5.0, fixed in 8.5.2.

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because o

Affected: from 8.0.0, fixed in 8.3.9; from 8.4.0, fixed in 8.4.6; from 8.5.0, fixed in 8.5.1; from 7.0, fixed in 7.58; from 8.0, fixed in 8.3.9; from 8.4.0, fixed in 8.4.6; from 8.5.0, fixed in 8.5.1.

Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used.

Affected: from 7.0, fixed in 7.57.

In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that…

Affected: from 8.4.0, fixed in 8.4.5.

In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated…

Affected: from 8.4.0, fixed in 8.4.5.

A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains.

Affected: from 7.0, fixed in 7.57; from 8.0, fixed in 8.4.0.

Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file…

Affected: from 7.0, fixed in 7.57.

Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to…

Affected: from 8.4.0, fixed in 8.4.5; from 7.0, fixed in 7.57.

In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not…

Affected: from 8.4.0, fixed in 8.4.5; from 7.0, fixed in 7.57.

Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module…

Affected: from 8.0, fixed in 8.2.8; from 8.3.0, fixed in 8.3.1.

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution.

Affected: from 8.0, fixed in 8.2.7.

Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF.

Affected: from 8.2.0, fixed in 8.2.7.

When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being…

Affected: from 8.2.0, fixed in 8.2.7.

The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL.

Affected: from 8.0, fixed in 8.2.3.

Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via…

Affected: from 7.0, fixed in 7.52; from 8.0, fixed in 8.2.3.

The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure…

Affected: from 8.0, fixed in 8.2.3.

The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information…

Affected: from 7.0, fixed in 7.52; from 8.0, fixed in 8.2.3.

The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote…

Affected: from 8.0, fixed in 8.1.10.

Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via…

Affected: from 8.0, fixed in 8.1.10.

Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the…

Affected: from 8.0.0, fixed in 8.1.10.

The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated…

Affected: from 8.0, fixed in 8.1.3.

The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom…

Affected: from 7.0, fixed in 7.44.

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from…

Affected: from 8.0, fixed in 8.1.7.

Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to…

Affected: from 6.0, fixed in 6.38.

The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to…

Affected: from 7.0, fixed in 7.43; from 8.0, fixed in 8.0.4.

The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or…

Affected: from 6.0, fixed in 6.38; from 7.0, fixed in 7.43.

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site…

Affected: from 6.0, fixed in 6.38; from 7.0, fixed in 7.43.

Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote…

Affected: from 6.0, fixed in 6.38.

CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote…

Affected: from 6.0, fixed in 6.38.

The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass…

Affected: from 6.0, fixed in 6.38.

Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging…

Affected: from 8.0, fixed in 8.0.4; from 7.0, fixed in 7.43; from 6.0, fixed in 6.38.

The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks…

Affected: from 7.0, fixed in 7.43; from 6.0, fixed in 6.38.

The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read…

Affected: from 7.0, fixed in 7.43; from 8.0, fixed in 8.0.4.

Drupal 7.x before 7.3 allows remote attackers to bypass intended node_access restrictions via vectors related to a listing that shows…

Affected: from 7.0, fixed in 7.3.