Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-13279Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043
- CVE-2024-13278Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042
- CVE-2024-13277Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041
- CVE-2024-13276File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040
- CVE-2024-13275Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039
- CVE-2024-13274Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038
- CVE-2024-13273Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037
- CVE-2024-13272Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036
- CVE-2024-13271Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035
- CVE-2024-13270Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2024-034
- CVE-2024-13269Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033
- CVE-2024-13268Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032
- CVE-2024-13267Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031
- CVE-2024-13266Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030
- CVE-2024-13265Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029
- CVE-2024-13264Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028
- CVE-2024-13263Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027
- CVE-2024-13262View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026
- CVE-2024-13261Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025
- CVE-2024-13260Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024
- CVE-2024-13259Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023
- CVE-2024-13258Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022
- CVE-2024-13257Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021
- CVE-2024-13256Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020
- CVE-2024-13255RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019
- CVE-2024-13254REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018
- CVE-2024-13253Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017
- CVE-2024-13252TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016
- CVE-2024-13251Registration role - Critical - Access bypass - SA-CONTRIB-2024-015
- CVE-2024-13250Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014