Login Request a demo
DR
CMS
Drupal
by Drupal · last CVE Oct 22, 2026
On CISA KEVExploited in the wildRansomware-linked
680
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Vulnerabilities680In the news7Timeline
Severity mix
Critical 44High 108Medium 347Low 1
Severity
All severities500Critical44High108Medium347Low1
Exploitation
On CISA KEV8Exploited in the wild8
Watch

Add Drupal to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2010-2473
6.5
1%
Nov 7
Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances
Affected: 5.0 before 5.22; 6.0 before 6.16
CVE-2017-6923
6.5
2%
Jan 22
Access bypass in Drupal 8 views
Affected: 8.x before 8.3.7
CVE-2017-6922
6.5
2%
Jan 22
Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
Affected: Drupal 8 before 8.3.3; Drupal 7 before 7.55
CVE-2018-14773
6.5
58%
Aug 3
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0…
Affected: 8.0.0 before 8.5.6
CVE-2017-6931
6.5
1%
Mar 1
In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for
Affected: 8.4.0 before 8.4.5
CVE-2016-9452
6.5
2%
Nov 25
The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL
Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more
CVE-2026-96376
6.4
1%
Oct 22
Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177
Affected: 0.0.0 before 7.0.1
CVE-2016-3168
6.4
2%
Apr 12
The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run…
Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more
CVE-2025-10928
6.3
0%
Oct 29
Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-108
Affected: 0.0.0 before 2.0.5
CVE-2024-13272
6.3
0%
Jan 9
Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036
Affected: 0.0.0 before 1.23.0; 2.0.0 before 2.0.2
CVE-2026-81201
6.1
0%
Sep 2
Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116
Affected: 0.0.0 before 9.5.3
CVE-2026-81160
6.1
0%
Sep 2
Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117
Affected: 0.0.0 before 2.1.0
CVE-2026-16638
6.1
0%
Aug 25
Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
Affected: 0.0.0 before 1.0.8
CVE-2026-16640
6.1
0%
Aug 25
Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082
Affected: 0.0.0 before 1.12.0
CVE-2026-58588
6.1
0%
Jul 10
Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066
Affected: 0.0.0 before 1.4.2; 1.5.0 before 1.5.2; 1.6.0 before 1.6.1; 1.7.0 before 1.7.1
CVE-2026-58587
6.1
0%
Jul 10
Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065
Affected: 0.0.0 before 1.4.2; 1.5.0 before 1.5.2; 1.6.0 before 1.6.1; 1.7.0 before 1.7.1
CVE-2026-13234
6.1
0%
Jul 10
AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054
Affected: 0.0.0 before 1.2.17; 1.3.0 before 1.3.8; 1.4.0 before 1.4.3
CVE-2026-13231
6.1
0%
Jul 10
Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051
Affected: 0.0.0 before 2.8.0
CVE-2026-10770
6.1
0%
Jul 10
Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042
Affected: 0.0.0 before 9.7.1
CVE-2026-6871
6.1
0%
May 19
Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033
Affected: 0.0.0 before 2.0.2
CVE-2026-6367
6.1
0%
May 19
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Affected: 11.3.0 before 11.3.7
CVE-2026-6365
6.1
0%
May 19
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Affected: 8.0.0 before 10.5.9; 10.6.0 before 10.6.7; 11.0.0 before 11.2.11; 11.3.0 before 11.3.7
CVE-2026-6095
6.1
0%
May 19
Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032
Affected: 0.0.0 before 2.0.16
CVE-2026-3529
6.1
0%
Mar 26
Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024
Affected: 0.0.0 before 1.1.14
CVE-2026-3528
6.1
0%
Mar 26
Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023
Affected: 0.0.0 before 1.0.4
CVE-2026-3217
6.1
0%
Mar 25
SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018
Affected: 0.0.0 before 3.1.3
CVE-2026-2349
6.1
0%
Mar 25
UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010
Affected: 0.0.0 before 1.0.1; 1.1.0 before 1.1.1
CVE-2026-0946
6.1
0%
Feb 4
AT Internet SmartTag - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-003
Affected: 0.0.0 before 1.0.1
CVE-2025-13984
6.1
0%
Jan 28
Next.js - Critical - Access bypass - SA-CONTRIB-2025-122
Affected: 0.0.0 before 1.6.4; 2.0.0 before 2.0.1
CVE-2026-0749
6.1
0%
Jan 28
Cross-Site Scripting Vulnerability in Drupal Form Builder Module
Affected: 7.x-1.0 through 7.x-1.22
CVE-2025-12848
6.1
0%
Nov 26
XSS vulnerability when rendering filename in Webform Multiform
Affected: 7.x-1.0 through 7.x-1.6
CVE-2025-12083
6.1
0%
Oct 29
CivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113
Affected: 0.0.0 before 1.12.0
CVE-2025-10927
6.1
0%
Oct 29
Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107
Affected: 0.0.0 before 1.0.2
CVE-2025-10926
6.1
0%
Oct 29
JSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106
Affected: 0.0.0 before 1.5
CVE-2025-9550
6.1
0%
Oct 10
Facets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100
Affected: 0.0.0 before 2.0.10; 3.0.0 before 3.0.1
CVE-2025-8362
6.1
0%
Aug 15
GoogleTag Manager - Moderately critical - Cross-site scripting - SA-CONTRIB-2025-094
Affected: 0.0.0 before 1.10.0
CVE-2025-7716
6.1
0%
Jul 21
Real-time SEO for Drupal - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-091
Affected: 2.0.0 before 2.2.0
CVE-2025-7715
6.1
0%
Jul 21
Block Attributes - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-090
Affected: 0.0.0 before 1.1.0; 2.0.0 before 2.0.1
CVE-2025-7392
6.1
0%
Jul 21
Cookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087
Affected: 1.0.0 before 1.2.4
CVE-2025-6674
6.1
0%
Jun 26
CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081
Affected: 0.0.0 before 1.0.4
CVE-2025-48922
6.1
0%
Jun 26
GLightbox - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-078
Affected: 0.0.0 before 1.0.16
CVE-2025-48923
6.1
0%
Jun 26
Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077
Affected: 0.0.0 before 3.2.1
CVE-2025-47705
6.1
0%
May 14
IFrame Remove Filter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-051
Affected: 7.x-1.0 through 7.x-1.5; 1.0 through 1.2; 2.0.0 before 2.0.5
CVE-2025-47704
6.1
0%
May 14
Klaro Cookie & Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-050
Affected: 0.0.0 before 3.0.5
CVE-2025-47703
6.1
0%
May 14
COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-049
Affected: 0.0.0 before 1.2.14
CVE-2025-47702
6.1
0%
May 14
oEmbed Providers - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-048
Affected: 0.0.0 before 2.2.2
CVE-2025-3902
6.1
0%
Apr 23
Block Class - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-043
Affected: 4.0.0 before 4.0.1
CVE-2025-3901
6.1
0%
Apr 23
Bootstrap Site Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-042
Affected: 0.0.0 before 1.13.0; 3.0.0 before 3.0.4
CVE-2025-3900
6.1
0%
Apr 23
Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041
Affected: 0.0.0 before 2.1.3
CVE-2025-31697
6.1
0%
Mar 31
Formatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026
Affected: 0.0.0 before 2.1.0
Page 2 of 7 · 347 total
123…7
The 500 most important CVEs for this product (exploited first, then by severity)