Login Request a demo
DR
CMS
Drupal
by Drupal · last CVE Oct 22, 2026
On CISA KEVExploited in the wildRansomware-linked
680
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Vulnerabilities680In the news7Timeline
Severity mix
Critical 44High 108Medium 347Low 1
Severity
All severities500Critical44High108Medium347Low1
Exploitation
On CISA KEV8Exploited in the wild8
Watch

Add Drupal to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-3130
5.4
0%
Apr 2
Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029
Affected: 0.0.0 before 2.0.1
CVE-2025-31675
5.4
1%
Mar 31
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004
Affected: 8.0.0 before 10.3.14; 10.4.0 before 10.4.5; 11.0.0 before 11.0.13; 11.1.0 before 11.1.5
CVE-2024-13309
5.4
0%
Jan 9
Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073
Affected: 2.0.0 before 2.1.1
CVE-2024-13294
5.4
0%
Jan 9
POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060
Affected: 0.0.0 before 1.0.2
CVE-2024-13289
5.4
0%
Jan 9
Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055
Affected: 0.0.0 before 1.0.18
CVE-2024-13287
5.4
0%
Jan 9
Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051
Affected: 0.0.0 before 1.0.1
CVE-2024-13286
5.4
0%
Jan 9
SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050
Affected: 0.0.0 before 2.1.2
CVE-2024-13273
5.4
0%
Jan 9
Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037
Affected: 0.0.0 before 12.3.8; 12.4.0 before 12.4.5
CVE-2024-13252
5.4
0%
Jan 9
TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016
Affected: 0.0.0 before 6.5.0
CVE-2024-13249
5.4
0%
Jan 9
Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013
Affected: 7.x-1.0 before 7.x-1.2
CVE-2024-13245
5.4
0%
Jan 9
CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009
Affected: 1.0.0 before 1.0.1
CVE-2024-13238
5.4
0%
Jan 9
Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002
Affected: 0.0.0 before 1.3.0
CVE-2024-13237
5.4
0%
Jan 9
File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001
Affected: 7.x-* before 7.x-2.38
CVE-2024-12393
5.4
0%
Dec 9
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003
Affected: 8.8.0 before 10.2.11; 10.3.0 before 10.3.9; 11.0.0 before 11.0.8
CVE-2022-25274
5.4
0%
Apr 26
Drupal 9.3 implemented a generic entity access API for entity revisions
Affected: 9.3.0 before 9.3.12
CVE-2022-24728
5.4
1%
Mar 16
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor
Affected: 8.0.0 before 9.2.15; 9.3.0 before 9.3.8
CVE-2021-41165
5.4
2%
Nov 17
CKEditor4 is an open source WYSIWYG HTML editor
Affected: 8.9.0 before 8.9.20; 9.1.0 before 9.1.14; 9.2.0 before 9.2.9
CVE-2021-41164
5.4
1%
Nov 17
CKEditor4 is an open source WYSIWYG HTML editor
Affected: 8.9.0 before 8.9.20; 9.1.0 before 9.1.14; 9.2.0 before 9.2.9
CVE-2019-10909
5.4
1%
May 16
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user…
Affected: 8.5.0 before 8.5.15; 8.6.0 before 8.6.15
CVE-2019-6341
5.4
12%
Mar 26
In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14
Affected: 7.0 before 7.65; 8.5.0 before 8.5.14; 8.6.0 before 8.6.13
CVE-2026-84914
5.3
0%
Oct 22
Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122
Affected: 0.0.0 before 2.0.3
CVE-2026-84920
5.3
0%
Oct 22
Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132
Affected: 0.0.0 before 1.8.0
CVE-2026-84921
5.3
0%
Oct 22
Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133
Affected: 0.0.0 before 1.2.0
CVE-2026-87950
5.3
0%
Oct 22
SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148
Affected: 0.0.0 before 3.2.0
CVE-2026-96366
5.3
0%
Oct 22
Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1
CVE-2026-96364
5.3
0%
Oct 22
Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171
Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1
CVE-2026-96356
5.3
0%
Oct 22
Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174
Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1
CVE-2026-96377
5.3
0%
Oct 22
Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188
Affected: 0.0.0 before 1.0.7
CVE-2026-73478
5.3
0%
Sep 2
Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096
Affected: 0.0.0 before 2.0.1; 2.1.0 before 2.1.1
CVE-2026-73474
5.3
0%
Sep 2
Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
Affected: 0.0.0 before 1.1.2
CVE-2026-73477
5.3
0%
Sep 2
Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
Affected: 0.0.0 before 4.3.1
CVE-2026-81165
5.3
0%
Sep 2
Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104
Affected: 0.0.0 before 3.0.18
CVE-2026-81269
5.3
0%
Sep 2
Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108
Affected: 0.0.0 before 2.0.13
CVE-2026-81166
5.3
0%
Sep 2
Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109
Affected: 0.0.0 before 2.6.1
CVE-2026-81162
5.3
0%
Sep 2
DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112
Affected: 0.0.0 before 2.8.1
CVE-2026-81158
5.3
0%
Sep 2
Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113
Affected: 0.0.0 before 1.8.0
CVE-2026-81205
5.3
0%
Sep 2
LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115
Affected: 0.0.0 before 2.2.1
CVE-2026-3526
5.3
0%
Mar 26
File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021
Affected: 0.0.0 before 1.2.0
CVE-2026-3525
5.3
0%
Mar 26
File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020
Affected: 0.0.0 before 1.2.0
CVE-2026-3210
5.3
0%
Mar 25
Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011
Affected: 0.0.0 before 2.0.4
CVE-2026-0944
5.3
0%
Feb 4
Group invite - Moderately critical - Access bypass - SA-CONTRIB-2026-001
Affected: 0.0.0 before 2.3.9; 3.0.0 before 3.0.4; 4.0.0 before 4.0.4
CVE-2025-13985
5.3
0%
Jan 28
Entity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123
Affected: 0.0.0 before 3.13.0
CVE-2025-13980
5.3
0%
Jan 28
CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118
Affected: 0.0.0 before 1.2.10; 1.3.0 before 1.3.6; 1.4.0 before 1.4.3; 1.5.0 before 1.5.1; 1.6.0 before 1.6.4
CVE-2025-13080
5.3
0%
Nov 18
Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005
Affected: 8.0.0 before 10.4.9; 10.5.0 before 10.5.6; 11.0.0 before 11.1.9; 11.2.0 before 11.2.8
CVE-2025-10929
5.3
0%
Oct 29
Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111
Affected: 0.0.0 before 1.1.2
CVE-2025-9554
5.3
0%
Oct 10
Owl Carousel 2 - Critical - Unsupported - SA-CONTRIB-2025-104
Affected: *.*
CVE-2025-9553
5.3
0%
Oct 10
API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103
Affected: *.*
CVE-2025-9552
5.3
0%
Oct 10
Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102
Affected: *.*
CVE-2025-7031
5.3
0%
Jul 8
Config Pages Viewer - Critical - Access bypass - SA-CONTRIB-2025-086
Affected: 0.0.0 before 1.0.4
CVE-2025-48013
5.3
0%
Jun 11
Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-065
Affected: 0.0.0 before 2.0.0
Page 8 of 10 · 500 total
1…78910
The 500 most important CVEs for this product (exploited first, then by severity)