Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-3061Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006
- CVE-2025-3060Flattern – Multipurpose Bootstrap Business Profile - Critical - Unsupported - SA-CONTRIB-2025-005
- CVE-2025-3059Profile Private - Critical - Unsupported - SA-CONTRIB-2025-002
- CVE-2025-31697Formatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026
- CVE-2025-31696RapiDoc OAS Field Formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-025
- CVE-2025-31695Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024
- CVE-2025-31694Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023
- CVE-2025-31693AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022
- CVE-2025-31692AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021
- CVE-2025-31691OAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020
- CVE-2025-31690Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019
- CVE-2025-31689General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018
- CVE-2025-31688Configuration Split - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-017
- CVE-2025-31687SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016
- CVE-2025-31686Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015
- CVE-2025-31685Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014
- CVE-2025-31684OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013
- CVE-2025-31683Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012
- CVE-2025-31682Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011
- CVE-2025-31681Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009
- CVE-2025-31680Matomo Analytics - Moderately critical - Cross site request forgery - SA-CONTRIB-2025-008
- CVE-2025-31679Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007
- CVE-2025-31678AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004
- CVE-2025-31677AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003
- CVE-2025-31676Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001
- CVE-2025-31675Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004
- CVE-2025-31674Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003
- CVE-2025-31673Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002
- CVE-2025-3057Drupal core - Critical - Cross site scripting - SA-CORE-2025-001
- CVE-2024-13312Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076