DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
680
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 44High 108Medium 347Low 1
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-11023 In wildKEV | 6.1 | Apr 29 | Potential XSS vulnerability in jQuery Affected: 7.0 before 7.70; 8.7.0 before 8.7.14; 8.8.0 before 8.8.6 |
| CVE-2025-31688 | 6.8 | Mar 31 | Configuration Split - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-017 Affected: 0.0.0 before 1.10.0; 2.0.0 before 2.0.2 |
| CVE-2025-31684 | 6.8 | Mar 31 | OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013 Affected: 0.0.0 before 4.1.3 |
| CVE-2025-31683 | 6.8 | Mar 31 | Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012 Affected: 0.0.0 before 1.8.0; 2.0.0 before 2.0.8 |
| CVE-2025-31680 | 6.8 | Mar 31 | Matomo Analytics - Moderately critical - Cross site request forgery - SA-CONTRIB-2025-008 Affected: 0.0.0 before 1.24.0 |
| CVE-2024-13268 | 6.8 | Jan 9 | Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032 Affected: 7.x-1.0 before 7.x-1.23 |
| CVE-2016-9451 | 6.8 | Nov 25 | Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2026-6366 | 6.6 | May 19 | Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002 Affected: 8.0.0 before 10.5.9; 10.6.0 before 10.6.7; 11.0.0 before 11.2.11; 11.3.0 before 11.3.7 |
| CVE-2025-3062 | 6.6 | Mar 31 | Drupal Admin LTE theme - Critical - Unsupported - SA-CONTRIB-2025-010 Affected: *.* |
| CVE-2025-3061 | 6.6 | Mar 31 | Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006 Affected: *.* |
| CVE-2025-3060 | 6.6 | Mar 31 | Flattern – Multipurpose Bootstrap Business Profile - Critical - Unsupported - SA-CONTRIB-2025-005 Affected: *.* |
| CVE-2025-31693 | 6.6 | Mar 31 | AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022 Affected: 0.0.0 before 1.0.5 |
| CVE-2024-13300 | 6.6 | Jan 9 | Print Anything - Critical - Unsupported - SA-CONTRIB-2024-066 Affected: *.* |
| CVE-2024-13299 | 6.6 | Jan 9 | Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065 Affected: *.* |
| CVE-2024-13297 | 6.6 | Jan 9 | Eloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-063 Affected: 7.x-* before 7.x-1.15 |
| CVE-2024-13296 | 6.6 | Jan 9 | Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062 Affected: 0.0.0 before 4.0.1 |
| CVE-2024-13295 | 6.6 | Jan 9 | Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061 Affected: 7.x-* before 7.x-3.3 |
| CVE-2026-84923 | 6.5 | Oct 22 | Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124 Affected: 0.0.0 before 2.4.0 |
| CVE-2026-84917 | 6.5 | Oct 22 | Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127 Affected: 0.0.0 before 2.0.2 |
| CVE-2026-87936 | 6.5 | Oct 22 | amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134 Affected: 0.0.0 before 1.3.7; 1.4.0 before 1.4.3 |
| CVE-2026-87937 | 6.5 | Oct 22 | Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135 Affected: 0.0.0 before 2.0.4; 2.1.0 before 2.1.3 |
| CVE-2026-87943 | 6.5 | Oct 22 | SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96385 | 6.5 | Oct 22 | REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96380 | 6.5 | Oct 22 | CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189 Affected: 1.0.0 before 1.0.2 |
| CVE-2026-96386 | 6.5 | Oct 22 | Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190 Affected: 0.0.0 before 3.2.1 |
| CVE-2026-13242 | 6.5 | Jul 10 | Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062 Affected: 0.0.0 before 3.15.0 |
| CVE-2026-13241 | 6.5 | Jul 10 | Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061 Affected: 0.0.0 before 1.21.0 |
| CVE-2026-13240 | 6.5 | Jul 10 | Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060 Affected: 0.0.0 before 1.21.0 |
| CVE-2026-13239 | 6.5 | Jul 10 | WissKI - Critical - Access bypass - SA-CONTRIB-2026-059 Affected: 0.0.0 before 4.2.0 |
| CVE-2026-1556 | 6.5 | Mar 26 | Information disclosure via file URI overwrite in File (Field) Paths Affected: 7.x-1.0 before 7.x-1.3 |
| CVE-2026-3531 | 6.5 | Mar 26 | OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026 Affected: 0.0.0 before 1.5.0 |
| CVE-2026-3527 | 6.5 | Mar 26 | AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022 Affected: 0.0.0 before 3.1.0 |
| CVE-2026-3214 | 6.5 | Mar 25 | CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015 Affected: 0.0.0 before 1.17.0; 2.0.0 before 2.0.10 |
| CVE-2026-0948 | 6.5 | Feb 4 | Microsoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-005 Affected: 0.0.0 before 1.0.4 |
| CVE-2025-9551 | 6.5 | Oct 10 | Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101 Affected: 0.0.0 before 1.8.0; 7.x-1.0 before 7.x-2.5 |
| CVE-2025-9549 | 6.5 | Oct 10 | Facets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099 Affected: 0.0.0 before 2.0.10; 3.0.0 before 3.0.1 |
| CVE-2025-7030 | 6.5 | Jul 8 | Two-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-085 Affected: 0.0.0 before 1.11.0 |
| CVE-2025-48916 | 6.5 | Jun 13 | Bookable Calendar - Less critical - Access bypass - SA-CONTRIB-2025-070 Affected: 0.0.0 before 2.2.13 |
| CVE-2025-48448 | 6.5 | Jun 11 | Admin Audit Trail - Less critical - Denial of Service - SA-CONTRIB-2025-068 Affected: 0.0.0 before 1.0.5 |
| CVE-2025-47709 | 6.5 | May 14 | Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055 Affected: 0.0.0 before 4.7.0; 5.0.0 before 5.2.0 |
| CVE-2025-3733 | 6.5 | Apr 16 | baguetteBox.js - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-034 Affected: 0.0.0 before 2.0.4; 3.0.0 before 3.0.1 |
| CVE-2025-3474 | 6.5 | Apr 9 | Panels - Critical - Access bypass - SA-CONTRIB-2025-033 Affected: 0.0.0 before 4.9.0 |
| CVE-2025-3475 | 6.5 | Apr 9 | WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030 Affected: 0.0.0 before 1.1.0 |
| CVE-2024-13310 | 6.5 | Jan 9 | Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074 Affected: *.* |
| CVE-2024-13243 | 6.5 | Jan 9 | Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007 Affected: 0.0.0 before 1.1.1 |
| CVE-2023-31250 | 6.5 | Apr 26 | The file download facility doesn't sufficiently sanitize file paths in certain situations Affected: 7.0 before 7.96; 9.4 before 9.4.14; 9.5 before 9.5.8; 10.0 before 10.0.8 |
| CVE-2022-25278 | 6.5 | Apr 26 | Under certain circumstances, the Drupal core form API evaluates form element access incorrectly Affected: 8.0.0 before 9.3.19; 9.4.0 before 9.4.3 |
| CVE-2022-25270 | 6.5 | Feb 17 | The Quick Edit module does not properly check entity access in some circumstances Affected: 9.2.0 before 9.2.13; 9.3.0 before 9.3.6 |
| CVE-2020-13676 | 6.5 | Feb 11 | The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data Affected: 8.9.0 before 8.9.19; 9.1.0 before 9.1.13; 9.2.0 before 9.2.6 |
| CVE-2020-13674 | 6.5 | Feb 11 | The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues Affected: 8.9.0 before 8.9.19; 9.1.0 before 9.1.13; 9.2.0 before 9.2.6 |
The 500 most important CVEs for this product (exploited first, then by severity)