DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
680
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 44High 108Medium 347Low 1
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-13671 In wildKEV | 8.8 | Nov 20 | Drupal core Un-restricted Upload of File Affected: 9.0 versions prior to 9.0.8; 8.9 versions prior to 8.9.9; 8.8 versions prior to 8.8.11; 7 versions prior to 7.74 |
| CVE-2019-6340 In wildKEV | 8.1 | Feb 21 | Drupal core - Highly critical - Remote Code Execution Affected: 8.5 before 8.5.11; 8.6 before 8.6.10 |
| CVE-2020-28949 In wildKEV | 7.8 | Nov 19 | PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability Affected: 7.0 before 7.75; 8.0.0 before 8.9.10; 8.8.0 before 8.8.12; 9.0.0 before 9.0.9 |
| CVE-2020-36193 In wildKEV | 7.5 | Jan 18 | PEAR Archive_Tar Improper Link Resolution Vulnerability Affected: 7.0 before 7.78; 8.9.0 before 8.9.13; 9.0.0 before 9.0.11; 9.1.0 before 9.1.3 |
| CVE-2026-0945 | 8.8 | Feb 4 | Role Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-002 Affected: 1.3.0 before 1.5.0 |
| CVE-2025-8093 | 8.8 | Oct 10 | Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098 Affected: 0.0.0 before 2.1.8 |
| CVE-2025-8675 | 8.8 | Aug 15 | AI SEO Link Advisor - Less critical - Server-side Request Forgery - SA-CONTRIB-2025-095 Affected: 0.0.0 before 1.0.6 |
| CVE-2025-48921 | 8.8 | Jun 26 | Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079 Affected: 0.0.0 before 12.3.14; 12.4.0 before 12.4.13 |
| CVE-2025-48918 | 8.8 | Jun 13 | Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071 Affected: 0.0.0 before 1.10.0 |
| CVE-2025-48446 | 8.8 | Jun 11 | Commerce Alphabank Redirect - Moderately critical - Access bypass - SA-CONTRIB-2025-067 Affected: 0.0.0 before 1.0.3 |
| CVE-2025-48445 | 8.8 | Jun 11 | Commerce Eurobank (Redirect) - Moderately critical - Access bypass - SA-CONTRIB-2025-066 Affected: 0.0.0 before 2.1.1 |
| CVE-2025-47708 | 8.8 | May 14 | Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054 Affected: 0.0.0 before 4.7.0; 5.0.0 before 5.2.0 |
| CVE-2025-47701 | 8.8 | May 14 | Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047 Affected: 0.0.0 before 1.3.0 |
| CVE-2025-31690 | 8.8 | Mar 31 | Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019 Affected: 0.0.0 before 1.2.1 |
| CVE-2025-31677 | 8.8 | Mar 31 | AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003 Affected: 1.0.0 before 1.0.2 |
| CVE-2025-31676 | 8.8 | Mar 31 | Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001 Affected: 2.0.0 before 2.0.3 |
| CVE-2024-13284 | 8.8 | Jan 9 | Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048 Affected: 0.0.0 before 2.13.0; 3.0.0 before 3.0.5 |
| CVE-2024-13282 | 8.8 | Jan 9 | Block permissions - Moderately critical - Access bypass - SA-CONTRIB-2024-046 Affected: 1.0.0 before 1.2.0 |
| CVE-2024-13260 | 8.8 | Jan 9 | Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024 Affected: 0.0.0 before 2.1.1 |
| CVE-2024-13251 | 8.8 | Jan 9 | Registration role - Critical - Access bypass - SA-CONTRIB-2024-015 Affected: 0.0.0 before 2.0.1 |
| CVE-2024-13250 | 8.8 | Jan 9 | Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014 Affected: 0.0.0 before 1.0.6 |
| CVE-2024-13244 | 8.8 | Jan 9 | Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008 Affected: 0.0.0 before 6.0.3 |
| CVE-2020-13663 | 8.8 | Jun 11 | Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities Affected: 7.0 before 7.72; 8.8.0 before 8.8.8; 8.9.0 before 8.9.1; 9.0.0 before 9.0.1 |
| CVE-2020-13664 | 8.8 | May 5 | Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances Affected: 8.8.0 before 8.8.8; 8.9.0 before 8.9.1; 9.0.0 before 9.0.1 |
| CVE-2016-6211 | 8.8 | Sep 9 | The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2025-48915 | 8.6 | Jun 13 | COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-076 Affected: 0.0.0 before 1.2.15 |
| CVE-2025-48914 | 8.6 | Jun 13 | COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075 Affected: 0.0.0 before 1.2.15 |
| CVE-2025-31678 | 8.2 | Mar 31 | AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004 Affected: 0.0.0 before 1.0.3 |
| CVE-2026-18985 | 8.1 | Aug 25 | Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093 Affected: 0.0.0 before 2.1.1 |
| CVE-2026-13244 | 8.1 | Jul 10 | Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064 Affected: 0.0.0 before 2.4.0 |
| CVE-2026-55810 | 8.1 | Jul 10 | Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050 Affected: 0.0.0 before 3.0.2 |
| CVE-2026-55809 | 8.1 | Jul 10 | Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049 Affected: 0.0.0 before 1.2 |
| CVE-2025-14472 | 8.1 | Jan 28 | Acquia Content Hub - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-125 Affected: 0.0.0 before 3.6.4; 3.7.0 before 3.7.3 |
| CVE-2025-13982 | 8.1 | Jan 28 | Login Time Restriction - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-120 Affected: 0.0.0 before 1.0.3 |
| CVE-2025-31694 | 8.1 | Mar 31 | Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023 Affected: 0.0.0 before 1.10.0 |
| CVE-2025-31689 | 8.1 | Mar 31 | General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018 Affected: 0.0.0 before 3.0.1; 3.1.0 before 3.1.2 |
| CVE-2025-31686 | 8.1 | Mar 31 | Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015 Affected: 0.0.0 before 12.3.11; 12.4.0 before 12.4.10 |
| CVE-2024-55634 | 8.1 | Dec 9 | Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004 Affected: 8.0.0 before 10.2.11; 10.3.0 before 10.3.9; 11.0.0 before 11.0.8 |
| CVE-2022-29248 | 8.1 | May 25 | Guzzle is a PHP HTTP client Affected: 9.2.0 before 9.2.20; 9.3.0 before 9.3.14 |
| CVE-2017-6930 | 8.1 | Mar 1 | In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback… Affected: 8.4.0 before 8.4.5 |
| CVE-2017-6926 | 8.1 | Mar 1 | In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add… Affected: 8.4.0 before 8.4.5 |
| CVE-2017-6381 | 8.1 | Mar 16 | A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2016-5385 | 8.1 | Jul 19 | PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in… Affected: 8.0.0 before 8.1.7 |
| CVE-2016-3171 | 8.1 | Apr 12 | Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2016-3169 | 8.1 | Apr 12 | The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2016-3162 | 8.1 | Apr 12 | The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2019-6338 | 8.0 | Jan 22 | third-party PEAR Archive_Tar library updates Affected: 7.x before 7.62; 8.6.x before 8.6.6.; 8.5.x before 8.5.9 |
| CVE-2020-28948 | 7.8 | Nov 19 | Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked Affected: 7.0 before 7.75; 8.0.0 before 8.9.10; 8.8.0 before 8.8.12; 9.0.0 before 9.0.9 |
| CVE-2025-8361 | 7.6 | Aug 15 | Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093 Affected: 0.0.0 before 2.18.0 |
| CVE-2025-8092 | 7.6 | Aug 15 | COOKiES Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-092 Affected: 0.0.0 before 1.2.16 |
The 500 most important CVEs for this product (exploited first, then by severity)