DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
680
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 44High 108Medium 347Low 1
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-0750 | 7.5 | Jan 28 | Payment bypass in Commerce Paybox Affected: 7-x-1.0 through 7.x-1.5 |
| CVE-2025-12466 | 7.5 | Oct 29 | Simple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass - SA-CONTRIB-2025-114 Affected: 6.0.0 before 6.0.7 |
| CVE-2025-12082 | 7.5 | Oct 29 | CivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-112 Affected: 0.0.0 before 1.12.0 |
| CVE-2025-9954 | 7.5 | Oct 29 | Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105 Affected: 0.0.0 before 1.1.5 |
| CVE-2025-7717 | 7.5 | Jul 21 | File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089 Affected: 0.0.0 before 1.9.0; 2.0.0 before 2.0.1 |
| CVE-2025-4416 | 7.5 | May 21 | Events Log Track - Moderately critical - Denial of Service - SA-CONTRIB-2025-059 Affected: 0.0.0 before 3.1.11; 4.0.0 before 4.0.2 |
| CVE-2025-47707 | 7.5 | May 14 | Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-053 Affected: 0.0.0 before 4.7.0; 5.0.0 before 5.2.0 |
| CVE-2025-31692 | 7.5 | Mar 31 | AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021 Affected: 0.0.0 before 1.0.5 |
| CVE-2025-31674 | 7.5 | Mar 31 | Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003 Affected: 8.0.0 before 10.3.13; 10.4.0 before 10.4.3; 11.0.0 before 11.0.12; 11.1.0 before 11.1.3 |
| CVE-2024-13276 | 7.5 | Jan 9 | File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040 Affected: 7.x-* before 7.x-2.39 |
| CVE-2024-13267 | 7.5 | Jan 9 | Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031 Affected: 7.x-1.0 before 7.x-1.3 |
| CVE-2024-13265 | 7.5 | Jan 9 | Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029 Affected: 0.0.0 before 3.1.2 |
| CVE-2024-13259 | 7.5 | Jan 9 | Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023 Affected: 0.0.0 before 3.0.2 |
| CVE-2024-13256 | 7.5 | Jan 9 | Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020 Affected: 0.0.0 before 2.0.4 |
| CVE-2024-13255 | 7.5 | Jan 9 | RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019 Affected: 7.x-2.0 before 7.x-2.10 |
| CVE-2024-13254 | 7.5 | Jan 9 | REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018 Affected: 0.0.0 before 3.0.1 |
| CVE-2024-13240 | 7.5 | Jan 9 | Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004 Affected: 0.0.0 before 12.05 |
| CVE-2024-11941 | 7.5 | Dec 5 | Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001 Affected: 10.2.0 before 10.2.2; 10.1.0 before 10.1.8 |
| CVE-2024-22362 | 7.5 | Jan 16 | Drupal contains a vulnerability with improper handling of structural elements Affected: prior to 9.5.x |
| CVE-2023-5256 | 7.5 | Sep 28 | Drupal core - Critical - Cache poisoning - SA-CORE-2023-006 Affected: 10.1 through 10.1.4; 10.0 through 10.0.11; 9.5 through 9.5.11 |
| CVE-2022-25275 | 7.5 | Apr 26 | In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the… Affected: 7.0 before 7.91; 8.0.0 before 9.3.19; 9.4.0 before 9.4.3 |
| CVE-2022-25273 | 7.5 | Apr 26 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation Affected: 8.0.0 before 9.2.18; 9.3.0 before 9.3.12 |
| CVE-2022-39261 | 7.5 | Sep 28 | Twig is a template language for PHP Affected: 8.0.0 before 9.3.22; 9.4.0 before 9.4.7 |
| CVE-2022-31043 | 7.5 | Jun 10 | Guzzle is an open source PHP HTTP client Affected: 9.2.0 before 9.2.21; 9.3.0 before 9.3.16; 9.4.0; 9.4.0; 9.4.0 |
| CVE-2022-31042 | 7.5 | Jun 10 | Guzzle is an open source PHP HTTP client Affected: 9.2.0 before 9.2.21; 9.3.0 before 9.3.16; 9.4.0; 9.4.0; 9.4.0 |
| CVE-2022-24775 | 7.5 | Mar 21 | guzzlehttp/psr7 is a PSR-7 HTTP message library Affected: 8.0.0 before 9.2.16; 9.3.0 before 9.3.9 |
| CVE-2022-24729 | 7.5 | Mar 16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor Affected: 8.0.0 before 9.2.15; 9.3.0 before 9.3.8 |
| CVE-2022-25271 | 7.5 | Feb 16 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation Affected: 7.0.0 before 7.88; 9.2.0 before 9.2.13; 9.3.0 before 9.3.6 |
| CVE-2020-13677 | 7.5 | Feb 11 | Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass Affected: 8.0.0 before 8.9.19; 9.1.0 before 9.1.13; 9.2.0 before 9.2.6 |
| CVE-2020-13670 | 7.5 | Feb 11 | Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access… Affected: 8.8.0 before 8.8.10; 8.9.0 before 8.9.6; 9.0.0 before 9.0.6 |
| CVE-2011-2726 | 7.5 | Nov 15 | An access bypass issue was found in Drupal 7.x before version 7.5 Affected: 7.0 before 7.5 |
| CVE-2019-10911 | 7.5 | May 16 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a… Affected: 8.5.0 before 8.5.15; 8.6.0 before 8.6.15 |
| CVE-2017-6919 | 7.5 | Apr 20 | Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH… Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2017-6379 | 7.5 | Mar 16 | Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF Affected: 8.2.0; 8.2.0; 8.2.0; 8.2.0; 8.2.0; 8.2.0; +6 more |
| CVE-2017-6377 | 7.5 | Mar 16 | When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass Affected: 8.2.0; 8.2.0; 8.2.0; 8.2.0; 8.2.0; 8.2.0; +6 more |
| CVE-2016-9450 | 7.5 | Nov 25 | The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2016-3165 | 7.5 | Apr 12 | The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2016-3163 | 7.5 | Apr 12 | The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2026-15081 | 7.4 | Jul 10 | Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072 Affected: 0.0.0 before 1.3.0 |
| CVE-2026-5343 | 7.4 | May 28 | SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031 Affected: 0.0.0 before 3.1.4 |
| CVE-2025-47710 | 7.4 | May 14 | Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-056 Affected: 0.0.0 before 4.7.0; 5.0.0 before 5.2.0 |
| CVE-2017-6924 | 7.4 | Jan 15 | REST API can bypass comment approval - Access Bypass - Moderately Critical Affected: Drupal 8 before 8.3.7 |
| CVE-2016-3167 | 7.4 | Apr 12 | Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2016-3164 | 7.4 | Apr 12 | Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2026-76782 | 7.3 | Sep 2 | Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 Affected: *.* |
| CVE-2026-76759 | 7.3 | Sep 2 | Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 Affected: *.* |
| CVE-2025-48920 | 7.3 | Jun 13 | etracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074 Affected: 0.0.0 before 3.1.0 |
| CVE-2025-3904 | 7.3 | Apr 23 | Sportsleague - Critical - Unsupported - SA-CONTRIB-2025-045 Affected: *.* |
| CVE-2025-3903 | 7.3 | Apr 23 | UEditor - 百度编辑器 - Critical - Unsupported - SA-CONTRIB-2025-044 Affected: *.* |
| CVE-2024-13311 | 7.3 | Jan 9 | Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075 Affected: *.* |
The 500 most important CVEs for this product (exploited first, then by severity)