DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
680
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 44High 108Medium 347Low 1
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-31696 | 6.1 | Mar 31 | RapiDoc OAS Field Formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-025 Affected: 0.0.0 before 1.0.1 |
| CVE-2025-31695 | 6.1 | Mar 31 | Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024 Affected: 0.0.0 before 1.6.0 |
| CVE-2025-31687 | 6.1 | Mar 31 | SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016 Affected: 0.0.0 before 3.2.1 |
| CVE-2025-31679 | 6.1 | Mar 31 | Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007 Affected: 0.0.0 before 1.0.4 |
| CVE-2025-3057 | 6.1 | Mar 31 | Drupal core - Critical - Cross site scripting - SA-CORE-2025-001 Affected: 8.0.0 before 10.3.13; 10.4.0 before 10.4.3; 11.0.0 before 11.0.12; 11.1.0 before 11.1.3 |
| CVE-2024-13301 | 6.1 | Jan 9 | OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067 Affected: 3.0.0 before 3.44.0; 4.0.0 before 4.0.19 |
| CVE-2024-13283 | 6.1 | Jan 9 | Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047 Affected: 0.0.0 before 2.0.9 |
| CVE-2024-55635 | 6.1 | Dec 9 | Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005 Affected: 7.0 before 7.102 |
| CVE-2022-25276 | 6.1 | Apr 26 | The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain Affected: 9.3.0 before 9.3.19; 9.4.0 before 9.4.3 |
| CVE-2020-13672 | 6.1 | Feb 11 | Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances Affected: before 7.80; 8.9.0 before 8.9.14; 9.0.0 before 9.0.12; 9.1.0 before 9.1.7 |
| CVE-2020-13669 | 6.1 | Feb 11 | Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS Affected: 8.8.0 before 8.8.10; 8.9.0 before 8.9.6; 9.0.0 before 9.0.6 |
| CVE-2020-13668 | 6.1 | Feb 11 | Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability Affected: 8.8.0 before 8.8.10; 8.9.0 before 8.9.6; 9.0.0 before 9.0.6 |
| CVE-2021-41184 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: 7.0 before 7.86; 9.2.0 before 9.2.11; 9.3.0 before 9.3.3 |
| CVE-2021-41183 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: 7.0 before 7.86; 9.2.0 before 9.2.11; 9.3.0 before 9.3.3 |
| CVE-2021-41182 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: 7.0 before 7.86 |
| CVE-2020-13688 | 6.1 | Jun 11 | Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability Affected: 8.8.0 before 8.8.10; 8.9.0 before 8.9.6; 9.0.0 before 9.0.6 |
| CVE-2021-33829 | 6.1 | Jun 9 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript… Affected: 8.9.0 before 8.9.16; 9.0.0 before 9.0.14; 9.1.0 before 9.1.9 |
| CVE-2020-13662 | 6.1 | May 5 | Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL Affected: 7.0 through 7.70 |
| CVE-2020-13666 | 6.1 | May 5 | Cross-site scripting vulnerability in Drupal Core Affected: 7.0 before 7.73; 8.8.0 before 8.8.10; 8.9.0 before 8.9.6; 9.0.0 before 9.0.6 |
| CVE-2020-11022 | 6.1 | Apr 29 | In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e Affected: 7.0 before 7.70; 8.7.0 before 8.7.14; 8.8.0 before 8.8.6 |
| CVE-2020-9281 | 6.1 | Mar 7 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted… Affected: 8.7.0 before 8.7.12; 8.8.0 before 8.8.4 |
| CVE-2011-2714 | 6.1 | Jan 14 | A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display Affected: 6.20 |
| CVE-2010-2250 | 6.1 | Nov 7 | Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack Affected: 5.0 before 5.22; 6.0 before 6.16 |
| CVE-2010-2471 | 6.1 | Nov 6 | Drupal versions 5.x and 6.x has open redirection Affected: 5.0 before 5.22; 6.0 before 6.16 |
| CVE-2019-11876 | 6.1 | May 24 | In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS Affected: 8.7.0 |
| CVE-2019-11358 | 6.1 | Apr 20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution Affected: 7.0 before 7.66; 8.5.0 before 8.5.15; 8.6.0 before 8.6.15 |
| CVE-2018-7603 | 6.1 | Jan 15 | Search Autocomplete Affected: 7.x-4.x before 7.x-4.8 |
| CVE-2018-9861 | 6.1 | Apr 19 | Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before… Affected: 8.0.0 before 8.4.7; 8.5.0 before 8.5.2 |
| CVE-2017-6929 | 6.1 | Mar 1 | A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains Affected: 7.0 before 7.57; 8.0.0 before 8.4.0 |
| CVE-2017-6927 | 6.1 | Mar 1 | Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before… Affected: 7.0 before 7.57; 8.4.0 before 8.4.5 |
| CVE-2015-7943 | 6.1 | Oct 18 | Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2015-2750 | 6.1 | Sep 13 | Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2015-2749 | 6.1 | Sep 13 | Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2016-7571 | 6.1 | Oct 3 | Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2010-5312 | 6.1 | Nov 24 | Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via… Affected: 7.0 before 7.86 |
| CVE-2026-76757 | 5.9 | Sep 2 | Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 Affected: *.* |
| CVE-2026-76756 | 5.9 | Sep 2 | Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 Affected: *.* |
| CVE-2026-76755 | 5.9 | Sep 2 | Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 Affected: *.* |
| CVE-2026-76758 | 5.9 | Sep 2 | Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101 Affected: *.* |
| CVE-2026-11914 | 5.9 | Jul 10 | Composer - Critical - Unsupported - SA-CONTRIB-2026-046 Affected: *.* |
| CVE-2026-11915 | 5.9 | Jul 10 | Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047 Affected: *.* |
| CVE-2026-15087 | 5.9 | Jul 10 | Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078 Affected: *.* |
| CVE-2026-15086 | 5.9 | Jul 10 | Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077 Affected: *.* |
| CVE-2026-55806 | 5.9 | Jul 10 | Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007 Affected: 0.0.0 before 10.5.12; 10.6.0 before 10.6.11; 11.2.0 before 11.2.14; 11.3.0 before 11.3.12; 0.0.0 before 11.0.*; 0.0.0 before 11.1.* |
| CVE-2026-55804 | 5.9 | Jul 10 | Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006 Affected: 0.0.0 before 10.5.12; 10.6.0 before 10.6.11; 11.2.0 before 11.2.14; 11.3.0 before 11.3.12; 0.0.0 before 11.0.*; 0.0.0 before 11.1.* |
| CVE-2026-55803 | 5.9 | Jul 10 | Drupal core - Critical - PHP object injection - SA-CORE-2026-005 Affected: 0.0.0 before 10.5.12; 10.6.0 before 10.6.11; 11.2.0 before 11.2.14; 11.3.0 before 11.3.12; 0.0.0 before 11.0.*; 0.0.0 before 11.1.* |
| CVE-2025-13081 | 5.9 | Nov 18 | Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006 Affected: 8.0.0 before 10.4.9; 10.5.0 before 10.5.6; 11.0.0 before 11.1.9; 11.2.0 before 11.2.8 |
| CVE-2025-3739 | 5.9 | Apr 16 | Drupal 8 Google Optimize Hide Page - Critical - Unsupported - SA-CONTRIB-2025-040 Affected: *.* |
| CVE-2025-3738 | 5.9 | Apr 16 | Google Optimize - Critical - Unsupported - SA-CONTRIB-2025-039 Affected: *.* |
| CVE-2025-3737 | 5.9 | Apr 16 | Google Maps: Store Locator - Critical - Unsupported - SA-CONTRIB-2025-038 Affected: *.* |
The 500 most important CVEs for this product (exploited first, then by severity)