DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
680
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 44High 108Medium 347Low 1
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-48444 | 5.3 | Jun 11 | Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064 Affected: 0.0.0 before 2.0.0 |
| CVE-2025-3059 | 5.3 | Mar 31 | Profile Private - Critical - Unsupported - SA-CONTRIB-2025-002 Affected: *.* |
| CVE-2024-13312 | 5.3 | Jan 9 | Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076 Affected: 11.8.0 before 12.3.10; 12.4.0 before 12.4.9 |
| CVE-2024-13303 | 5.3 | Jan 9 | Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069 Affected: 0.0.0 before 2.0.2 |
| CVE-2024-13302 | 5.3 | Jan 9 | Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068 Affected: 2.0.0 before 2.0.3 |
| CVE-2024-13290 | 5.3 | Jan 9 | OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056 Affected: 0.0.0 before 2.0.4 |
| CVE-2024-13275 | 5.3 | Jan 9 | Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039 Affected: 0.0.0 before 2.0.3 |
| CVE-2024-13274 | 5.3 | Jan 9 | Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038 Affected: 0.0.0 before 12.3.8; 12.4.0 before 12.4.5 |
| CVE-2024-13269 | 5.3 | Jan 9 | Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033 Affected: 0.0.0 before 4.0.11 |
| CVE-2024-13266 | 5.3 | Jan 9 | Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030 Affected: 0.0.0 before 4.4.4 |
| CVE-2024-13257 | 5.3 | Jan 9 | Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021 Affected: 0.0.0 before 1.0.3 |
| CVE-2024-13246 | 5.3 | Jan 9 | Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010 Affected: 0.0.0 before 2.0.2 |
| CVE-2024-45440 | 5.3 | Aug 29 | core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist Affected: v11.x-dev |
| CVE-2020-13667 | 5.3 | May 17 | Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions Affected: 8.8.0 before 8.8.10; 8.9.0 before 8.9.6; 9.0.0 before 9.0.6 |
| CVE-2017-6928 | 5.3 | Mar 1 | Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or… Affected: 7.0 before 7.57 |
| CVE-2016-6212 | 5.3 | Sep 9 | The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2016-3170 | 5.3 | Apr 12 | The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2026-3216 | 5.0 | Mar 25 | Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017 Affected: 0.0.0 before 1.1.1 |
| CVE-2025-48919 | 5.0 | Jun 13 | Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-073 Affected: 0.0.0 before 1.10.0 |
| CVE-2025-48917 | 5.0 | Jun 13 | EU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072 Affected: 0.0.0 before 1.26.0 |
| CVE-2026-87944 | 4.8 | Oct 22 | SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-87946 | 4.8 | Oct 22 | SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-87947 | 4.8 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-96375 | 4.8 | Oct 22 | Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176 Affected: 0.0.0 before 7.0.1 |
| CVE-2026-18986 | 4.8 | Sep 2 | Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094 Affected: 0.0.0 before 2.16.0 |
| CVE-2026-81167 | 4.8 | Sep 2 | Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103 Affected: 0.0.0 before 1.0.25 |
| CVE-2026-13243 | 4.8 | Jul 10 | Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063 Affected: 0.0.0 before 5.1.3 |
| CVE-2026-13238 | 4.8 | Jul 10 | Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058 Affected: 0.0.0 before 3.0.2 |
| CVE-2026-13237 | 4.8 | Jul 10 | AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057 Affected: 0.0.0 before 1.1.4; 1.2.0 before 1.2.5; 1.3.0 before 1.3.1 |
| CVE-2026-3218 | 4.8 | Mar 25 | Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019 Affected: 0.0.0 before 2.0.2 |
| CVE-2026-1553 | 4.8 | Feb 4 | Drupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-006 Affected: 0.0.0 before 1.0.4 |
| CVE-2026-0947 | 4.8 | Feb 4 | AT Internet Piano Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-004 Affected: 0.0.0 before 1.0.1; 2.0.0 before 2.3.1 |
| CVE-2025-14557 | 4.8 | Jan 14 | XSS in Drupal 7 Facebook Pixel Module Affected: 7.x-1.0 through 7.x-1.1 |
| CVE-2025-6675 | 4.8 | Jun 26 | Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-082 Affected: 0.0.0 before 4.8.0; 5.2.0 before 5.2.1; 0.0.0 before 5.0.*; 0.0.0 before 5.1.* |
| CVE-2025-48012 | 4.8 | May 21 | One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063 Affected: 0.0.0 before 1.3.0 |
| CVE-2025-48011 | 4.8 | May 21 | One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062 Affected: 0.0.0 before 1.3.0 |
| CVE-2025-48010 | 4.8 | May 21 | One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061 Affected: 0.0.0 before 1.3.0 |
| CVE-2025-4415 | 4.8 | May 21 | Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058 Affected: 0.0.0 before 1.3.2 |
| CVE-2025-47706 | 4.8 | May 14 | Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052 Affected: 0.0.0 before 4.7.0; 5.0.0 before 5.2.0 |
| CVE-2025-3129 | 4.8 | Apr 2 | Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028 Affected: 0.0.0 before 2.0.4 |
| CVE-2025-31682 | 4.8 | Mar 31 | Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011 Affected: 0.0.0 before 1.8.0; 2.0.0 before 2.0.8 |
| CVE-2024-13305 | 4.8 | Jan 9 | Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071 Affected: 0.0.0 before 1.1.4 |
| CVE-2024-13298 | 4.8 | Jan 9 | Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064 Affected: 2.0.0 before 2.0.5 |
| CVE-2024-13292 | 4.8 | Jan 9 | Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058 Affected: 0.0.0 before 1.1.2 |
| CVE-2024-13262 | 4.8 | Jan 9 | View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026 Affected: 0.0.0 before 6.0.4 |
| CVE-2024-13247 | 4.8 | Jan 9 | Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011 Affected: 0.0.0 before 1.4.0 |
| CVE-2010-2472 | 4.8 | Nov 7 | Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language… Affected: 5.0 before 5.22; 6.0 before 6.16 |
| CVE-2026-15917 | 4.7 | Aug 25 | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011 Affected: 11.3.0 before 11.3.14; 11.4.0 before 11.4.4; 0.0.0 before 11.2.* |
| CVE-2026-3213 | 4.7 | Mar 25 | Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014 Affected: 0.0.0 before 9.7.0 |
| CVE-2017-6932 | 4.7 | Mar 1 | Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used Affected: 7.0 before 7.57 |
The 500 most important CVEs for this product (exploited first, then by severity)