Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-13249Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013
- CVE-2024-13248Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012
- CVE-2024-13247Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011
- CVE-2024-13246Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010
- CVE-2024-13245CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009
- CVE-2024-13244Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008
- CVE-2024-13243Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007
- CVE-2024-13242Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006
- CVE-2024-13241Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005
- CVE-2024-13240Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004
- CVE-2024-13239Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003
- CVE-2024-13238Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002
- CVE-2024-13237File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001
- CVE-2024-55638Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008
- CVE-2024-55637Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
- CVE-2024-55636Drupal core - Less critical - Gadget chain - SA-CORE-2024-006
- CVE-2024-55635Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005
- CVE-2024-55634Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004
- CVE-2024-12393Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003
- CVE-2024-11942Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002
- CVE-2024-11941Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001
- CVE-2024-45440core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_co
- CVE-2023-5256Drupal core - Critical - Cache poisoning - SA-CORE-2023-006
- CVE-2023-31250Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005
- CVE-2022-25278Under certain circumstances, the Drupal core form API evaluates form element access incorrectly.
- CVE-2022-25277Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots fro
- CVE-2022-25276The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of th
- CVE-2022-25275In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when g
- CVE-2022-25274Drupal 9.3 implemented a generic entity access API for entity revisions.
- CVE-2022-25273Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation