Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-4415Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058
- CVE-2025-47710Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-056
- CVE-2025-47709Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055
- CVE-2025-47708Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054
- CVE-2025-47707Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-053
- CVE-2025-47706Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052
- CVE-2025-47705IFrame Remove Filter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-051
- CVE-2025-47704Klaro Cookie & Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-050
- CVE-2025-47703COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-049
- CVE-2025-47702oEmbed Providers - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-048
- CVE-2025-47701Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047
- CVE-2025-3907Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046
- CVE-2025-3904Sportsleague - Critical - Unsupported - SA-CONTRIB-2025-045
- CVE-2025-3903UEditor - 百度编辑器 - Critical - Unsupported - SA-CONTRIB-2025-044
- CVE-2025-3902Block Class - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-043
- CVE-2025-3901Bootstrap Site Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-042
- CVE-2025-3900Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041
- CVE-2025-3739Drupal 8 Google Optimize Hide Page - Critical - Unsupported - SA-CONTRIB-2025-040
- CVE-2025-3738Google Optimize - Critical - Unsupported - SA-CONTRIB-2025-039
- CVE-2025-3737Google Maps: Store Locator - Critical - Unsupported - SA-CONTRIB-2025-038
- CVE-2025-3736Simple GTM - Critical - Unsupported - SA-CONTRIB-2025-037
- CVE-2025-3735Panelizer (obsolete) - Critical - Unsupported - SA-CONTRIB-2025-036
- CVE-2025-3734Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035
- CVE-2025-3733baguetteBox.js - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-034
- CVE-2025-3474Panels - Critical - Access bypass - SA-CONTRIB-2025-033
- CVE-2025-3131ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031
- CVE-2025-3475WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030
- CVE-2025-3130Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029
- CVE-2025-3129Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028
- CVE-2025-3062Drupal Admin LTE theme - Critical - Unsupported - SA-CONTRIB-2025-010