DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
680
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 44High 108Medium 347Low 1
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-3736 | 5.9 | Apr 16 | Simple GTM - Critical - Unsupported - SA-CONTRIB-2025-037 Affected: *.* |
| CVE-2025-3735 | 5.9 | Apr 16 | Panelizer (obsolete) - Critical - Unsupported - SA-CONTRIB-2025-036 Affected: *.* |
| CVE-2025-3734 | 5.9 | Apr 16 | Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035 Affected: 0.0.0 before 3.1.5 |
| CVE-2024-11942 | 5.9 | Dec 5 | Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002 Affected: 10.0.0 before 10.2.10 |
| CVE-2017-6921 | 5.9 | Jan 15 | File REST resource does not properly validate Affected: Drupal 8 before 8.3.4 |
| CVE-2016-3166 | 5.9 | Apr 12 | CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2026-16646 | 5.7 | Aug 25 | PanKM - Critical - Unsupported - SA-CONTRIB-2026-083 Affected: *.* |
| CVE-2026-16642 | 5.7 | Aug 25 | Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085 Affected: *.* |
| CVE-2026-16643 | 5.7 | Aug 25 | Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086 Affected: *.* |
| CVE-2026-15088 | 5.7 | Aug 25 | Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089 Affected: *.* |
| CVE-2026-18260 | 5.7 | Aug 25 | Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110 Affected: 0.0.0 before 1.1.4 |
| CVE-2026-18261 | 5.7 | Aug 25 | Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092 Affected: *.* |
| CVE-2024-13263 | 5.5 | Jan 9 | Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027 Affected: 0.0.0 before 3.1.1 |
| CVE-2024-13248 | 5.5 | Jan 9 | Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012 Affected: 0.0.0 before 2.1.0 |
| CVE-2026-84924 | 5.4 | Oct 22 | Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125 Affected: 0.0.0 before 2.4.0 |
| CVE-2026-81163 | 5.4 | Oct 22 | Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129 Affected: 0.0.0 before 2.1.6 |
| CVE-2026-87940 | 5.4 | Oct 22 | Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138 Affected: 0.0.0 before 2.2.4 |
| CVE-2026-87945 | 5.4 | Oct 22 | SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96370 | 5.4 | Oct 22 | Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96371 | 5.4 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96372 | 5.4 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-96388 | 5.4 | Oct 22 | Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184 Affected: 0.0.0 before 3.0.4 |
| CVE-2026-73476 | 5.4 | Sep 2 | External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098 Affected: 0.0.0 before 2.0.13 |
| CVE-2026-81164 | 5.4 | Sep 2 | Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114 Affected: 0.0.0 before 2.1.5 |
| CVE-2026-55805 | 5.4 | Aug 25 | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012 Affected: 0.0.0 before 10.6.13; 11.3.0 before 11.3.14; 11.4.0 before 11.4.4; 0.0.0 before 11.0.*; 0.0.0 before 11.1.*; 0.0.0 before 11.2.* |
| CVE-2026-55808 | 5.4 | Jul 10 | Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009 Affected: 0.0.0 before 10.5.12; 10.6.0 before 10.6.11; 11.2.0 before 11.2.14; 11.3.0 before 11.3.12; 0.0.0 before 11.0.*; 0.0.0 before 11.1.* |
| CVE-2026-15085 | 5.4 | Jul 10 | AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076 Affected: 0.0.0 before 1.1.3 |
| CVE-2026-15084 | 5.4 | Jul 10 | UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075 Affected: 2.0.0 before 2.0.17 |
| CVE-2026-15082 | 5.4 | Jul 10 | Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073 Affected: 0.0.0 before 2.0.1 |
| CVE-2026-15079 | 5.4 | Jul 10 | Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070 Affected: 0.0.0 before 2.1.4 |
| CVE-2026-58591 | 5.4 | Jul 10 | Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069 Affected: 0.0.0 before 2.1.5; 0.0.0 before 2.2.0 |
| CVE-2026-58590 | 5.4 | Jul 10 | FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068 Affected: 0.0.0 before 1.6.0 |
| CVE-2026-58589 | 5.4 | Jul 10 | FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067 Affected: 0.0.0 before 1.6.0 |
| CVE-2026-11908 | 5.4 | Jul 10 | Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043 Affected: 0.0.0 before 1.2.52 |
| CVE-2026-10769 | 5.4 | Jul 10 | Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041 Affected: 3.3.0 before 3.3.6 |
| CVE-2026-4093 | 5.4 | May 21 | Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels) Affected: 7.x-1.x through 7.x-1.11 |
| CVE-2026-4929 | 5.4 | May 21 | Simple Hierarchical Select (Drupal 7) XSS in term-derived output Affected: 7.x-1.0 before 7.x-1.11 |
| CVE-2026-8493 | 5.4 | May 19 | Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036 Affected: 0.0.0 before 2.1.1 |
| CVE-2026-3215 | 5.4 | Mar 25 | Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016 Affected: 0.0.0 before 2.17.5 |
| CVE-2026-3212 | 5.4 | Mar 25 | Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013 Affected: 0.0.0 before 1.2.49 |
| CVE-2026-2348 | 5.4 | Mar 25 | Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009 Affected: 0.0.0 before 1.0.5; 2.0.0 before 2.0.1 |
| CVE-2025-13983 | 5.4 | Jan 28 | Tagify - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-121 Affected: 0.0.0 before 1.2.44 |
| CVE-2025-13979 | 5.4 | Jan 28 | Mini site - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-117 Affected: 0.0.0 before 3.0.2 |
| CVE-2025-14556 | 5.4 | Jan 14 | XSS in Drupal 7 Flag Module Affected: 7.x-3.0 through 7.x-3.9 |
| CVE-2025-12760 | 5.4 | Nov 18 | Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-115 Affected: 0.0.0 before 2.0.6 |
| CVE-2025-6677 | 5.4 | Jun 26 | Paragraphs table - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-084 Affected: 2.0.0 before 2.0.5 |
| CVE-2025-6676 | 5.4 | Jun 26 | Simple XML sitemap - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-083 Affected: 0.0.0 before 4.2.2 |
| CVE-2025-3131 | 5.4 | Apr 9 | ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031 Affected: 0.0.0 before 1.1.12; 2.0.0 before 2.0.16; 2.1.0 before 2.1.7; 0.0.0 before 1.2.* |
| CVE-2025-3130 | 5.4 | Apr 2 | Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029 Affected: 0.0.0 before 2.0.1 |
| CVE-2025-31675 | 5.4 | Mar 31 | Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004 Affected: 8.0.0 before 10.3.14; 10.4.0 before 10.4.5; 11.0.0 before 11.0.13; 11.1.0 before 11.1.5 |
The 500 most important CVEs for this product (exploited first, then by severity)