# drupal/core (Packagist) vulnerabilities

121 known vulnerabilities (5 critical, 18 high, 27 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/drupal/core

## Advisories (121)

### [CVE-2026-108097](https://cve.now/CVE-2026-108097): Drupal core - Critical - Remote code execution - SA-CORE-2026-014

- Severity: High 8.1
- Published: Oct 30, 2026
- Affected: from 8.9.0, fixed in 10.6.19; from 11.0.0, fixed in 11.3.19; from 11.4.0, fixed in 11.4.10; from 12.0.0-alpha1, fixed in 12.0.0-beta2.

### [CVE-2026-108515](https://cve.now/CVE-2026-108515): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015

- Severity: Medium 6.5
- Published: Oct 30, 2026
- Affected: from 8.9.0, fixed in 10.6.19; from 11.0.0, fixed in 11.3.19; from 11.4.0, fixed in 11.4.10; from 12.0.0-alpha1, fixed in 12.0.0-beta2.

### [CVE-2026-108514](https://cve.now/CVE-2026-108514): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

- Severity: Medium 6.5
- Published: Oct 30, 2026
- Affected: from 10.3.0, fixed in 10.6.19; from 11.0.0, fixed in 11.3.19; from 11.4.0, fixed in 11.4.10; from 12.0.0-alpha1, fixed in 12.0.0-beta2.

### [CVE-2026-15916](https://cve.now/CVE-2026-15916): Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

- Severity: Medium 4.2
- Published: Aug 25, 2026
- Affected: fixed in 10.6.13; from 11.3.0, fixed in 11.3.14; from 11.4.0, fixed in 11.4.4; from 11.0.0, fixed in 11.1.0; from 11.1.0, fixed in 11.2.0; from 11.2.0, fixed in 11.3.0.

### [CVE-2026-15917](https://cve.now/CVE-2026-15917): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

- Severity: Medium 4.7
- Published: Aug 25, 2026
- Affected: from 11.3.0, fixed in 11.3.14; from 11.4.0, fixed in 11.4.4; from 11.2.0, fixed in 11.3.0.

### [CVE-2026-55805](https://cve.now/CVE-2026-55805): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

- Severity: Medium 5.4
- Published: Aug 25, 2026
- Affected: fixed in 10.6.13; from 11.3.0, fixed in 11.3.14; from 11.4.0, fixed in 11.4.4; from 11.0.0, fixed in 11.1.0; from 11.1.0, fixed in 11.2.0; from 11.2.0, fixed in 11.3.0.

### [CVE-2026-55808](https://cve.now/CVE-2026-55808): Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

- Severity: Medium 5.4
- Published: Jul 10, 2026
- Affected: fixed in 10.5.12; from 10.6.0, fixed in 10.6.11; from 11.2.0, fixed in 11.2.14; from 11.3.0, fixed in 11.3.12; from 11.0.0, fixed in 11.1.0; from 11.1.0, fixed in 11.2.0.

### [CVE-2026-55807](https://cve.now/CVE-2026-55807): Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

- Severity: Low 3.1
- Published: Jul 10, 2026
- Affected: fixed in 10.5.12; from 10.6.0, fixed in 10.6.11; from 11.2.0, fixed in 11.2.14; from 11.3.0, fixed in 11.3.12; from 11.0.0, fixed in 11.1.0; from 11.1.0, fixed in 11.2.0.

### [CVE-2026-55806](https://cve.now/CVE-2026-55806): Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

- Severity: Medium 5.9
- Published: Jul 10, 2026
- Affected: fixed in 10.5.12; from 10.6.0, fixed in 10.6.11; from 11.2.0, fixed in 11.2.14; from 11.3.0, fixed in 11.3.12; from 11.0.0, fixed in 11.1.0; from 11.1.0, fixed in 11.2.0.

### [CVE-2026-55804](https://cve.now/CVE-2026-55804): Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

- Severity: Medium 5.9
- Published: Jul 10, 2026
- Affected: fixed in 10.5.12; from 10.6.0, fixed in 10.6.11; from 11.2.0, fixed in 11.2.14; from 11.3.0, fixed in 11.3.12; from 11.0.0, fixed in 11.1.0; from 11.1.0, fixed in 11.2.0.

### [CVE-2026-55803](https://cve.now/CVE-2026-55803): Drupal core - Critical - PHP object injection - SA-CORE-2026-005

- Severity: Medium 5.9
- Published: Jul 10, 2026
- Affected: fixed in 10.5.12; from 10.6.0, fixed in 10.6.11; from 11.2.0, fixed in 11.2.14; from 11.3.0, fixed in 11.3.12; from 11.0.0, fixed in 11.1.0; from 11.1.0, fixed in 11.2.0.

### [CVE-2026-9082](https://cve.now/CVE-2026-9082): Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

- Severity: Critical 9.8 · KEV
- Published: May 20, 2026
- Affected: from 8.9.0, fixed in 10.4.10; from 10.5.0, fixed in 10.5.10; from 10.6.0, fixed in 10.6.9; from 11.0.0, fixed in 11.1.10; from 11.2.0, fixed in 11.2.12; from 11.3.0, fixed in 11.3.10; from 8.9.0, fixed in 10.4.10; from 10.5.0, fixed in 10.5.10; from 10.6.0, fixed in 10.6.9; from 11.0.0, fixed in 11.1.10; from 11.2.0, fixed in 11.2.12; from 11.3.0, fixed in 11.3.10.

### [CVE-2026-6367](https://cve.now/CVE-2026-6367): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003

- Severity: Medium 6.1
- Published: May 19, 2026
- Affected: from 11.3.0, fixed in 11.3.7.

### [CVE-2026-6366](https://cve.now/CVE-2026-6366): Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

- Severity: Medium 6.6
- Published: May 19, 2026
- Affected: from 8.0.0, fixed in 10.5.9; from 10.6.0, fixed in 10.6.7; from 11.0.0, fixed in 11.2.11; from 11.3.0, fixed in 11.3.7; from 8.0.0, fixed in 10.5.9; from 10.6.0, fixed in 10.6.7; from 11.0.0, fixed in 11.2.11; from 11.3.0, fixed in 11.3.7.

### [CVE-2026-6365](https://cve.now/CVE-2026-6365): Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001

- Severity: Medium 6.1
- Published: May 19, 2026
- Affected: from 8.0.0, fixed in 10.5.9; from 10.6.0, fixed in 10.6.7; from 11.0.0, fixed in 11.2.11; from 11.3.0, fixed in 11.3.7; from 8.0.0, fixed in 10.5.9; from 10.6.0, fixed in 10.6.7; from 11.0.0, fixed in 11.2.11; from 11.3.0, fixed in 11.3.7.

### [CVE-2025-13083](https://cve.now/CVE-2025-13083): Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

- Severity: Low 3.7
- Published: Nov 18, 2025
- Affected: from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8; from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8; from 7.0, fixed in 7.103.

### [CVE-2025-13082](https://cve.now/CVE-2025-13082): Drupal core - Moderately critical - Defacement - SA-CORE-2025-007

- Severity: Medium 4.3
- Published: Nov 18, 2025
- Affected: from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8; from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8.

### [CVE-2025-13081](https://cve.now/CVE-2025-13081): Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006

- Severity: Medium 5.9
- Published: Nov 18, 2025
- Affected: from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8; from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8.

### [CVE-2025-13080](https://cve.now/CVE-2025-13080): Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005

- Severity: Medium 5.3
- Published: Nov 18, 2025
- Affected: from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8; from 8.0.0, fixed in 10.4.9; from 10.5.0, fixed in 10.5.6; from 11.0.0, fixed in 11.1.9; from 11.2.0, fixed in 11.2.8.

### [CVE-2025-31675](https://cve.now/CVE-2025-31675): Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

- Severity: Medium 5.4
- Published: Mar 31, 2025
- Affected: from 8.0.0, fixed in 10.3.14; from 10.4.0, fixed in 10.4.5; from 11.0.0, fixed in 11.0.13; from 11.1.0, fixed in 11.1.5; from 8.0.0, fixed in 10.3.14; from 10.4.0, fixed in 10.4.5; from 11.0.0, fixed in 11.0.13; from 11.1.0, fixed in 11.1.5.

### [CVE-2025-31674](https://cve.now/CVE-2025-31674): Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

- Severity: High 7.5
- Published: Mar 31, 2025
- Affected: from 8.0.0, fixed in 10.3.13; from 10.4.0, fixed in 10.4.3; from 11.0.0, fixed in 11.0.12; from 11.1.0, fixed in 11.1.3; from 8.0.0, fixed in 10.3.13; from 10.4.0, fixed in 10.4.3; from 11.0.0, fixed in 11.0.12; from 11.1.0, fixed in 11.1.3.

### [CVE-2025-31673](https://cve.now/CVE-2025-31673): Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

- Severity: Medium 4.6
- Published: Mar 31, 2025
- Affected: from 8.0.0, fixed in 10.3.13; from 10.4.0, fixed in 10.4.3; from 11.0.0, fixed in 11.0.12; from 11.1.0, fixed in 11.1.3; from 8.0.0, fixed in 10.3.13; from 10.4.0, fixed in 10.4.3; from 11.0.0, fixed in 11.0.12; from 11.1.0, fixed in 11.1.3.

### [CVE-2025-3057](https://cve.now/CVE-2025-3057): Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

- Severity: Medium 6.1
- Published: Mar 31, 2025
- Affected: from 8.0.0, fixed in 10.3.13; from 10.4.0, fixed in 10.4.3; from 11.0.0, fixed in 11.0.12; from 11.1.0, fixed in 11.1.3; from 8.0.0, fixed in 10.3.13; from 10.4.0, fixed in 10.4.3; from 11.0.0, fixed in 11.0.12; from 11.1.0, fixed in 11.1.3.

### [CVE-2024-55638](https://cve.now/CVE-2024-55638): Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008

- Severity: Critical 9.8
- Published: Dec 9, 2024
- Affected: from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 7.0, fixed in 7.102; from 8.0.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9.

### [CVE-2024-55637](https://cve.now/CVE-2024-55637): Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007

- Severity: Critical 9.8
- Published: Dec 9, 2024
- Affected: from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8; from 8.0.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

### [CVE-2024-55636](https://cve.now/CVE-2024-55636): Drupal core - Less critical - Gadget chain - SA-CORE-2024-006

- Severity: Critical 9.8
- Published: Dec 9, 2024
- Affected: from 8.0.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8; from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

### [CVE-2024-55634](https://cve.now/CVE-2024-55634): Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004

- Severity: High 8.1
- Published: Dec 9, 2024
- Affected: from 8.0.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8; from 8.0.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

### [CVE-2024-12393](https://cve.now/CVE-2024-12393): Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003

- Severity: Medium 5.4
- Published: Dec 9, 2024
- Affected: from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8; from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

### [CVE-2024-11942](https://cve.now/CVE-2024-11942): Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002

- Severity: Medium 5.9
- Published: Dec 5, 2024
- Affected: from 10.0.0, fixed in 10.2.10.

### [CVE-2024-11941](https://cve.now/CVE-2024-11941): Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001

- Severity: High 7.5
- Published: Dec 5, 2024
- Affected: from 8.0.0, fixed in 10.1.8; from 10.2.0, fixed in 10.2.2; from 10.1.0, fixed in 10.1.8; from 10.2.0, fixed in 10.2.2.

### [CVE-2024-45440](https://cve.now/CVE-2024-45440): core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash\_salt is…

- Severity: Medium 5.3
- Published: Aug 29, 2024
- Affected: from 10.3.0, fixed in 10.3.6; from 11.0.0, fixed in 11.0.5; from 8.0.0, fixed in 10.2.9.

### [CVE-2024-22362](https://cve.now/CVE-2024-22362): Drupal contains a vulnerability with improper handling of structural elements.

- Severity: High 7.5
- Published: Jan 16, 2024
- Affected: versions 9.3.6.

### [CVE-2023-5256](https://cve.now/CVE-2023-5256): Drupal core - Critical - Cache poisoning - SA-CORE-2023-006

- Severity: High 7.5
- Published: Sep 28, 2023
- Affected: from 8.7.0, fixed in 9.5.11; from 10.0.0, fixed in 10.0.11; from 10.1.0, fixed in 10.1.4; from 8.7.0, fixed in 9.5.11; from 10.0.0, fixed in 10.0.11; from 10.1.0, fixed in 10.1.4.

### [CVE-2023-31250](https://cve.now/CVE-2023-31250): Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005

- Severity: Medium 6.5
- Published: Apr 26, 2023
- Affected: from 8.0.0, fixed in 9.4.14; from 9.5.0, fixed in 9.5.8; from 10.0.0, fixed in 10.0.8; from 10.0.0, fixed in 10.0.8; from 9.5.0, fixed in 9.5.8; from 9.0.0, fixed in 9.4.14; from 7.0.0, fixed in 7.96.

### [CVE-2022-25278](https://cve.now/CVE-2022-25278): Under certain circumstances, the Drupal core form API evaluates form element access incorrectly.

- Severity: Medium 6.5
- Published: Apr 26, 2023
- Affected: from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3; from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3.

### [CVE-2022-25277](https://cve.now/CVE-2022-25277): Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots…

- Severity: High 7.2
- Published: Apr 26, 2023
- Affected: from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3; from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3.

### [CVE-2022-25276](https://cve.now/CVE-2022-25276): The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of…

- Severity: Medium 6.1
- Published: Apr 26, 2023
- Affected: from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3; from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3.

### [CVE-2022-25275](https://cve.now/CVE-2022-25275): In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when…

- Severity: High 7.5
- Published: Apr 26, 2023
- Affected: from 7.0.0, fixed in 7.91; from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3; from 8.0.0, fixed in 9.3.19; from 9.4.0, fixed in 9.4.3.

### [CVE-2022-25274](https://cve.now/CVE-2022-25274): Drupal 9.3 implemented a generic entity access API for entity revisions.

- Severity: Medium 5.4
- Published: Apr 26, 2023
- Affected: from 9.3.0, fixed in 9.3.12.

### [CVE-2022-25273](https://cve.now/CVE-2022-25273): Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input…

- Severity: High 7.5
- Published: Apr 26, 2023
- Affected: from 8.0.0, fixed in 9.2.18; from 9.3.0, fixed in 9.3.12; from 8.0.0, fixed in 9.2.18; from 9.3.0, fixed in 9.3.12.

### [CVE-2022-39261](https://cve.now/CVE-2022-39261): Twig may load a template outside a configured directory when using the filesystem loader

- Severity: High 7.5
- Published: Sep 28, 2022
- Affected: from 8.0.0, fixed in 9.3.22; from 9.4.0, fixed in 9.4.7.

### [CVE-2022-31043](https://cve.now/CVE-2022-31043): Fix failure to strip Authorization header on HTTP downgrade in Guzzle

- Severity: High 7.5
- Published: Jun 9, 2022
- Affected: from 8.0.0, fixed in 9.2.21; from 9.3.0, fixed in 9.3.16.

### [CVE-2022-31042](https://cve.now/CVE-2022-31042): Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle

- Severity: High 7.5
- Published: Jun 9, 2022
- Affected: from 8.0.0, fixed in 9.2.21; from 9.3.0, fixed in 9.3.16.

### [CVE-2022-29248](https://cve.now/CVE-2022-29248): Cross-domain cookie leakage in Guzzle

- Severity: High 8.0
- Published: May 25, 2022
- Affected: from 8.0.0, fixed in 9.2.20; from 9.3.0, fixed in 9.3.14.

### [CVE-2022-24775](https://cve.now/CVE-2022-24775): Improper Input Validation in guzzlehttp/psr7

- Severity: High 7.5
- Published: Mar 21, 2022
- Affected: from 8.0.0, fixed in 9.2.16; from 9.3.0, fixed in 9.3.9.

### [CVE-2022-24729](https://cve.now/CVE-2022-24729): Regular expression Denial of Service in dialog plugin

- Severity: Medium 6.5
- Published: Mar 16, 2022
- Affected: from 8.0.0, fixed in 9.2.15; from 9.3.0, fixed in 9.3.8.

### [CVE-2022-24728](https://cve.now/CVE-2022-24728): Cross-site Scripting in CKEditor4

- Severity: Medium 5.4
- Published: Mar 16, 2022
- Affected: from 8.0.0, fixed in 9.2.15; from 9.3.0, fixed in 9.3.8.

### [CVE-2022-25270](https://cve.now/CVE-2022-25270): The Quick Edit module does not properly check entity access in some circumstances.

- Severity: Unrated
- Published: Feb 16, 2022
- Affected: from 9.3.0, fixed in 9.3.6; from 8.0.0, fixed in 9.2.13; from 8.0.0, fixed in 9.2.13; from 9.3.0, fixed in 9.3.6.

### [CVE-2022-25271](https://cve.now/CVE-2022-25271): Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input…

- Severity: Unrated
- Published: Feb 16, 2022
- Affected: from 8.0.0, fixed in 9.2.13; from 9.3.0, fixed in 9.3.6; from 9.3.0, fixed in 9.3.6; from 8.0.0, fixed in 9.2.13; from 7.0.0, fixed in 7.88.

### [CVE-2020-13677](https://cve.now/CVE-2020-13677): Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in…

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6; from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6.

### [CVE-2020-13676](https://cve.now/CVE-2020-13676): The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data.

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6; from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6.

### [CVE-2020-13670](https://cve.now/CVE-2020-13670): Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent…

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6; from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6.

### [CVE-2020-13674](https://cve.now/CVE-2020-13674): The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances…

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6; from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6.

### [CVE-2020-13675](https://cve.now/CVE-2020-13675): Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs.

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6; from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6.

### [CVE-2020-13673](https://cve.now/CVE-2020-13673): The Entity Embed module provides a filter to allow embedding entities in content fields.

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: from 8.0.0, fixed in 8.9.19; from 9.1.0, fixed in 9.1.13; from 9.2.0, fixed in 9.2.6.

### [CVE-2020-13672](https://cve.now/CVE-2020-13672): Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain…

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: from 7.0.0, fixed in 7.80; from 8.0.0, fixed in 8.9.14; from 9.0.0, fixed in 9.0.12; from 9.1.0, fixed in 9.1.7; from 8.0.0, fixed in 8.9.14; from 9.0.0, fixed in 9.0.12; from 9.1.0, fixed in 9.1.7.

### [CVE-2020-13669](https://cve.now/CVE-2020-13669): Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS.

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6; from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6.

### [CVE-2020-13668](https://cve.now/CVE-2020-13668): Access bypass in Drupal Core 8/9

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6.

### [CVE-2021-32610](https://cve.now/CVE-2021-32610): In Archive\_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

- Severity: Unrated
- Published: Jul 27, 2021
- Affected: from 8.0.0, fixed in 8.9.17; from 9.1.0, fixed in 9.1.11; from 9.2.0, fixed in 9.2.2.

### [CVE-2020-13688](https://cve.now/CVE-2020-13688): Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in…

- Severity: Unrated
- Published: Jun 11, 2021
- Affected: from 8.8.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6; from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6.

### [CVE-2020-13663](https://cve.now/CVE-2020-13663): Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests…

- Severity: Unrated
- Published: Jun 11, 2021
- Affected: from 8.9.0, fixed in 8.9.1; from 9.0.0, fixed in 9.0.1; from 7.0.0, fixed in 7.72; from 8.0.0, fixed in 8.8.8; from 8.0.0, fixed in 8.8.8; from 8.9.0, fixed in 8.9.1; from 9.0.0, fixed in 9.0.1.

### [CVE-2021-33829](https://cve.now/CVE-2021-33829): A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote…

- Severity: Unrated
- Published: Jun 9, 2021
- Affected: from 7.0.0, fixed in 7.80; from 8.0.0, fixed in 8.9.16; from 9.0.0, fixed in 9.0.14; from 9.1.0, fixed in 9.1.9; from 8.0.0, fixed in 8.9.16; from 9.0.0, fixed in 9.0.14; from 9.1.0, fixed in 9.1.9.

### [CVE-2020-13667](https://cve.now/CVE-2020-13667): Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions.

- Severity: Unrated
- Published: May 17, 2021
- Affected: from 8.8.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6; from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6.

### [CVE-2020-13664](https://cve.now/CVE-2020-13664): Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances.

- Severity: Unrated
- Published: May 5, 2021
- Affected: from 8.8.0, fixed in 8.8.8; from 8.9.0, fixed in 8.9.1; from 9.0.0, fixed in 9.0.1; from 8.0.0, fixed in 8.8.8; from 8.9.0, fixed in 8.9.1; from 9.0.0, fixed in 9.0.1.

### [CVE-2020-13662](https://cve.now/CVE-2020-13662): Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to…

- Severity: Unrated
- Published: May 5, 2021
- Affected: from 7.0.0, fixed in 7.70.

### [CVE-2020-13665](https://cve.now/CVE-2020-13665): Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode.

- Severity: Unrated
- Published: May 5, 2021
- Affected: from 8.8.0, fixed in 8.8.8; from 8.9.0, fixed in 8.9.1; from 9.0.0, fixed in 9.0.1.

### [CVE-2020-13666](https://cve.now/CVE-2020-13666): Cross-site scripting vulnerability in Drupal Core.

- Severity: Unrated
- Published: May 5, 2021
- Affected: from 8.8.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6; from 7.0.0, fixed in 7.73; from 8.0.0, fixed in 8.8.10; from 8.9.0, fixed in 8.9.6; from 9.0.0, fixed in 9.0.6.

### [CVE-2020-13671](https://cve.now/CVE-2020-13671): Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect exten

- Severity: High 8.8 · KEV
- Published: Nov 20, 2020
- Affected: from 8.0.0, fixed in 8.8.11; from 8.9.0, fixed in 8.9.9; from 9.0.0, fixed in 9.0.8; from 9.0.0, fixed in 9.0.8; from 8.9.0, fixed in 8.9.9; from 8.0.0, fixed in 8.8.11; from 7.0.0, fixed in 7.74.

### [CVE-2020-28948](https://cve.now/CVE-2020-28948): Archive\_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

- Severity: Unrated
- Published: Nov 19, 2020
- Affected: from 8.0.0, fixed in 8.8.12; from 8.9.0, fixed in 8.9.10; from 9.0.0, fixed in 9.0.9.

### [CVE-2020-28949](https://cve.now/CVE-2020-28949): Archive\_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as fil

- Severity: High 7.8 · KEV
- Published: Nov 19, 2020
- Affected: from 8.0.0, fixed in 8.8.12; from 8.9.0, fixed in 8.9.10; from 9.0.0, fixed in 9.0.9.

### [CVE-2019-6342](https://cve.now/CVE-2019-6342): Drupal core - Critical - Access bypass - SA-CORE-2019-008

- Severity: Unrated
- Published: May 28, 2020
- Affected: from 8.7.4, fixed in 8.7.5.

### [CVE-2011-2715](https://cve.now/CVE-2011-2715): An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column…

- Severity: Unrated
- Published: Jan 14, 2020
- Affected: versions 6.20.

### [CVE-2011-2714](https://cve.now/CVE-2011-2714): A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table…

- Severity: Unrated
- Published: Jan 14, 2020
- Affected: versions 6.20.

### [CVE-2019-10909](https://cve.now/CVE-2019-10909): In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not…

- Severity: Unrated
- Published: May 16, 2019
- Affected: from 8.0.0, fixed in 8.5.15; from 8.6.0, fixed in 8.6.15.

### [CVE-2019-11831](https://cve.now/CVE-2019-11831): The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory…

- Severity: Unrated
- Published: May 9, 2019
- Affected: from 7.0.0, fixed in 7.67.0; from 8.0.0, fixed in 8.6.16; from 8.7.0, fixed in 8.7.1; from 8.0.0, fixed in 8.6.16; from 8.7.0, fixed in 8.7.1.

### [CVE-2019-11358](https://cve.now/CVE-2019-11358): jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of…

- Severity: Unrated
- Published: Apr 19, 2019
- Affected: from 8.0.0, fixed in 8.5.15; from 8.6.0, fixed in 8.6.15.

### [CVE-2019-6341](https://cve.now/CVE-2019-6341): Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004

- Severity: Unrated
- Published: Mar 26, 2019
- Affected: from 7.0.0, fixed in 7.65.0; from 8.0.0, fixed in 8.5.14; from 8.6.0, fixed in 8.6.13; from 8.0.0, fixed in 8.5.14; from 8.6.0, fixed in 8.6.13.

### [CVE-2019-6340](https://cve.now/CVE-2019-6340): Drupal core - Highly critical - Remote Code Execution

- Severity: High 8.1 · KEV
- Published: Feb 21, 2019
- Affected: from 8.0.0, fixed in 8.5.11; from 8.6.0, fixed in 8.6.10; from 8.6.0, fixed in 8.6.10; from 7.0.0, fixed in 7.62.0; from 8.0.0, fixed in 8.5.11.

### [CVE-2017-6923](https://cve.now/CVE-2017-6923): Access bypass in Drupal 8 views

- Severity: Unrated
- Published: Jan 22, 2019
- Affected: from 8.0, fixed in 8.3.7.

### [CVE-2019-6339](https://cve.now/CVE-2019-6339): PHAR stream wrapper Arbitrary PHP code execution

- Severity: Unrated
- Published: Jan 22, 2019
- Affected: from 8.0.0, fixed in 8.5.9; from 8.6.0, fixed in 8.6.6; from 7.0.0, fixed in 7.62.0; from 8.0.0, fixed in 8.5.9; from 8.6.0, fixed in 8.6.6.

### [CVE-2019-6338](https://cve.now/CVE-2019-6338): third-party PEAR Archive\_Tar library updates

- Severity: Unrated
- Published: Jan 22, 2019
- Affected: from 8.0.0, fixed in 8.5.9; from 8.6.0, fixed in 8.6.6.

### [CVE-2017-6922](https://cve.now/CVE-2017-6922): Files uploaded by anonymous users into a private file system can be accessed by other anonymous users

- Severity: Unrated
- Published: Jan 22, 2019
- Affected: from 7.0, fixed in 7.56; from 8.0, fixed in 8.3.4.

### [CVE-2017-6921](https://cve.now/CVE-2017-6921): File REST resource does not properly validate

- Severity: Unrated
- Published: Jan 15, 2019
- Affected: from 8.0, fixed in 8.3.4.

### [CVE-2017-6924](https://cve.now/CVE-2017-6924): REST API can bypass comment approval - Access Bypass - Moderately Critical

- Severity: Unrated
- Published: Jan 15, 2019
- Affected: from 8.0, fixed in 8.3.7.

### [CVE-2017-6925](https://cve.now/CVE-2017-6925): In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to…

- Severity: Unrated
- Published: Jan 15, 2019
- Affected: from 8.0, fixed in 8.3.7.

### [CVE-2017-6920](https://cve.now/CVE-2017-6920): Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects…

- Severity: Unrated
- Published: Aug 6, 2018
- Affected: from 8.0, fixed in 8.3.4.

### [CVE-2018-7602](https://cve.now/CVE-2018-7602): Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

- Severity: High 8.1 · KEV
- Published: Jul 19, 2018
- Affected: from 8.0.0, fixed in 8.4.8; from 8.5.0, fixed in 8.5.3; from 7.0, fixed in 7.59; from 8.0, fixed in 8.4.8; from 8.5, fixed in 8.5.3.

### [CVE-2018-9861](https://cve.now/CVE-2018-9861): Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed…

- Severity: Unrated
- Published: Apr 19, 2018
- Affected: from 8.5.0, fixed in 8.5.2; from 8.0, fixed in 8.4.7; from 8.0.0, fixed in 8.4.7; from 8.5.0, fixed in 8.5.2.

### [CVE-2018-7600](https://cve.now/CVE-2018-7600): Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because o

- Severity: Critical 9.8 · KEV
- Published: Mar 29, 2018
- Affected: from 8.0.0, fixed in 8.3.9; from 8.4.0, fixed in 8.4.6; from 8.5.0, fixed in 8.5.1; from 7.0, fixed in 7.58; from 8.0, fixed in 8.3.9; from 8.4.0, fixed in 8.4.6; from 8.5.0, fixed in 8.5.1.

### [CVE-2017-6932](https://cve.now/CVE-2017-6932): Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used.

- Severity: Unrated
- Published: Mar 1, 2018
- Affected: from 7.0, fixed in 7.57.

### [CVE-2017-6931](https://cve.now/CVE-2017-6931): In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that…

- Severity: Unrated
- Published: Mar 1, 2018
- Affected: from 8.4.0, fixed in 8.4.5.

### [CVE-2017-6930](https://cve.now/CVE-2017-6930): In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated…

- Severity: Unrated
- Published: Mar 1, 2018
- Affected: from 8.4.0, fixed in 8.4.5.

### [CVE-2017-6929](https://cve.now/CVE-2017-6929): A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains.

- Severity: Unrated
- Published: Mar 1, 2018
- Affected: from 7.0, fixed in 7.57; from 8.0, fixed in 8.4.0.

### [CVE-2017-6928](https://cve.now/CVE-2017-6928): Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file…

- Severity: Unrated
- Published: Mar 1, 2018
- Affected: from 7.0, fixed in 7.57.

### [CVE-2017-6927](https://cve.now/CVE-2017-6927): Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to…

- Severity: Unrated
- Published: Mar 1, 2018
- Affected: from 8.4.0, fixed in 8.4.5; from 7.0, fixed in 7.57.

### [CVE-2017-6926](https://cve.now/CVE-2017-6926): In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not…

- Severity: Unrated
- Published: Mar 1, 2018
- Affected: from 8.4.0, fixed in 8.4.5; from 7.0, fixed in 7.57.

### [CVE-2017-6919](https://cve.now/CVE-2017-6919): Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module…

- Severity: Unrated
- Published: Apr 20, 2017
- Affected: from 8.0, fixed in 8.2.8; from 8.3.0, fixed in 8.3.1.

### [CVE-2017-6381](https://cve.now/CVE-2017-6381): A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution.

- Severity: Unrated
- Published: Mar 16, 2017
- Affected: from 8.0, fixed in 8.2.7.

### [CVE-2017-6379](https://cve.now/CVE-2017-6379): Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF.

- Severity: Unrated
- Published: Mar 16, 2017
- Affected: from 8.2.0, fixed in 8.2.7.

### [CVE-2017-6377](https://cve.now/CVE-2017-6377): When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being…

- Severity: Unrated
- Published: Mar 16, 2017
- Affected: from 8.2.0, fixed in 8.2.7.

### [CVE-2016-9452](https://cve.now/CVE-2016-9452): The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL.

- Severity: Unrated
- Published: Nov 25, 2016
- Affected: from 8.0, fixed in 8.2.3.

### [CVE-2016-9451](https://cve.now/CVE-2016-9451): Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via…

- Severity: Unrated
- Published: Nov 25, 2016
- Affected: from 7.0, fixed in 7.52; from 8.0, fixed in 8.2.3.

### [CVE-2016-9450](https://cve.now/CVE-2016-9450): The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure…

- Severity: Unrated
- Published: Nov 25, 2016
- Affected: from 8.0, fixed in 8.2.3.

### [CVE-2016-9449](https://cve.now/CVE-2016-9449): The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information…

- Severity: Unrated
- Published: Nov 25, 2016
- Affected: from 7.0, fixed in 7.52; from 8.0, fixed in 8.2.3.

### [CVE-2016-7572](https://cve.now/CVE-2016-7572): The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote…

- Severity: Unrated
- Published: Oct 3, 2016
- Affected: from 8.0, fixed in 8.1.10.

### [CVE-2016-7571](https://cve.now/CVE-2016-7571): Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via…

- Severity: Unrated
- Published: Oct 3, 2016
- Affected: from 8.0, fixed in 8.1.10.

### [CVE-2016-7570](https://cve.now/CVE-2016-7570): Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the…

- Severity: Unrated
- Published: Oct 3, 2016
- Affected: from 8.0.0, fixed in 8.1.10.

### [CVE-2016-6212](https://cve.now/CVE-2016-6212): The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated…

- Severity: Unrated
- Published: Sep 9, 2016
- Affected: from 8.0, fixed in 8.1.3.

### [CVE-2016-6211](https://cve.now/CVE-2016-6211): The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom…

- Severity: Unrated
- Published: Sep 9, 2016
- Affected: from 7.0, fixed in 7.44.

### [CVE-2016-5385](https://cve.now/CVE-2016-5385): PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from…

- Severity: Unrated
- Published: Jul 19, 2016
- Affected: from 8.0, fixed in 8.1.7.

### [CVE-2016-3171](https://cve.now/CVE-2016-3171): Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to…

- Severity: Unrated
- Published: Apr 12, 2016
- Affected: from 6.0, fixed in 6.38.

### [CVE-2016-3170](https://cve.now/CVE-2016-3170): The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to…

- Severity: Unrated
- Published: Apr 12, 2016
- Affected: from 7.0, fixed in 7.43; from 8.0, fixed in 8.0.4.

### [CVE-2016-3169](https://cve.now/CVE-2016-3169): The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or…

- Severity: Unrated
- Published: Apr 12, 2016
- Affected: from 6.0, fixed in 6.38; from 7.0, fixed in 7.43.

### [CVE-2016-3168](https://cve.now/CVE-2016-3168): The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site…

- Severity: Unrated
- Published: Apr 12, 2016
- Affected: from 6.0, fixed in 6.38; from 7.0, fixed in 7.43.

### [CVE-2016-3167](https://cve.now/CVE-2016-3167): Open redirect vulnerability in the drupal\_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote…

- Severity: Unrated
- Published: Apr 12, 2016
- Affected: from 6.0, fixed in 6.38.

### [CVE-2016-3166](https://cve.now/CVE-2016-3166): CRLF injection vulnerability in the drupal\_set\_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote…

- Severity: Unrated
- Published: Apr 12, 2016
- Affected: from 6.0, fixed in 6.38.

### [CVE-2016-3165](https://cve.now/CVE-2016-3165): The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass…

- Severity: Unrated
- Published: Apr 12, 2016
- Affected: from 6.0, fixed in 6.38.

### [CVE-2016-3164](https://cve.now/CVE-2016-3164): Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging…

- Severity: Unrated
- Published: Apr 12, 2016
- Affected: from 8.0, fixed in 8.0.4; from 7.0, fixed in 7.43; from 6.0, fixed in 6.38.

### [CVE-2016-3163](https://cve.now/CVE-2016-3163): The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks…

- Severity: Unrated
- Published: Apr 12, 2016
- Affected: from 7.0, fixed in 7.43; from 6.0, fixed in 6.38.

### [CVE-2016-3162](https://cve.now/CVE-2016-3162): The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read…

- Severity: Unrated
- Published: Apr 12, 2016
- Affected: from 7.0, fixed in 7.43; from 8.0, fixed in 8.0.4.

### [CVE-2011-2687](https://cve.now/CVE-2011-2687): Drupal 7.x before 7.3 allows remote attackers to bypass intended node\_access restrictions via vectors related to a listing that shows…

- Severity: Unrated
- Published: Jul 27, 2011
- Affected: from 7.0, fixed in 7.3.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/drupal/core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.