Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-13083Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008
- CVE-2025-13082Drupal core - Moderately critical - Defacement - SA-CORE-2025-007
- CVE-2025-13081Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006
- CVE-2025-13080Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005
- CVE-2025-12466Simple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass - SA-CONTRIB-2025-114
- CVE-2025-12083CivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113
- CVE-2025-12082CivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-112
- CVE-2025-10929Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111
- CVE-2025-10930Currency - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-110
- CVE-2025-10931Umami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109
- CVE-2025-10928Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-108
- CVE-2025-10927Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107
- CVE-2025-10926JSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106
- CVE-2025-9954Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105
- CVE-2025-9554Owl Carousel 2 - Critical - Unsupported - SA-CONTRIB-2025-104
- CVE-2025-9553API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103
- CVE-2025-9552Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102
- CVE-2025-9551Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101
- CVE-2025-9550Facets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100
- CVE-2025-9549Facets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099
- CVE-2025-8093Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098
- CVE-2025-8996Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097
- CVE-2025-8995Authenticator Login - Highly critical - Access bypass - SA-CONTRIB-2025-096
- CVE-2025-8675AI SEO Link Advisor - Less critical - Server-side Request Forgery - SA-CONTRIB-2025-095
- CVE-2025-8362GoogleTag Manager - Moderately critical - Cross-site scripting - SA-CONTRIB-2025-094
- CVE-2025-8361Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093
- CVE-2025-8092COOKiES Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-092
- CVE-2025-7717File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089
- CVE-2025-7716Real-time SEO for Drupal - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-091
- CVE-2025-7715Block Attributes - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-090