Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2017-6921File REST resource does not properly validate
- CVE-2017-6924REST API can bypass comment approval - Access Bypass - Moderately Critical
- CVE-2018-7602Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
- CVE-2017-6381A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution.
- CVE-2017-6379Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF.
- CVE-2017-6377When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attach