Drupal (Drupal) - vulnerabilities (CVEs)

279 CVEs, 0 in the last 30 days, 792 known versions, newest CVE from 2026-07-10. Vendor: Drupal.

CVEs of Drupal

• CVE-2026-55808 - CVSS 5.4 (medium), 2026-07-10: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).…
• CVE-2026-55807 - CVSS 3.1 (low), 2026-07-10: Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0…
• CVE-2026-55804 - CVSS 5.9 (medium), 2026-07-10: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects…
• CVE-2026-55806 - CVSS 5.9 (medium), 2026-07-10: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from…
• CVE-2026-55803 - CVSS 5.9 (medium), 2026-07-10: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects…
• CVE-2026-9082 - CVSS 9.8 (critical), 2026-05-20: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue…
• CVE-2026-6367 - CVSS 6.1 (medium), 2026-05-19: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).…
• CVE-2026-6366 - CVSS 6.6 (medium), 2026-05-19: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects…
• CVE-2026-6365 - CVSS 6.1 (medium), 2026-05-19: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).…
• CVE-2026-0749 - CVSS 6.1 (medium), 2026-01-28: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Form Builder allows Cross-Site Scripting…
• CVE-2025-12848 - CVSS 7 (high), 2025-11-26: Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker…
• CVE-2025-13083 - CVSS 3.7 (low), 2025-11-18: Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security…
• CVE-2025-13082 - CVSS 4.3 (medium), 2025-11-18: User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from…
• CVE-2025-13080 - CVSS 5.3 (medium), 2025-11-18: Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0…
• CVE-2025-13081 - CVSS 5.9 (medium), 2025-11-18: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects…
• CVE-2025-3057 - CVSS 6.1 (medium), 2025-03-31: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting…
• CVE-2025-31675 - CVSS 5.4 (medium), 2025-03-31: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting…
• CVE-2025-31674 - CVSS 7.5 (high), 2025-03-31: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects…
• CVE-2025-31673 - CVSS 4.6 (medium), 2025-03-31: Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0…
• CVE-2024-55634 - CVSS 8.1 (high), 2024-12-10: A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0…
• CVE-2024-55637 - CVSS 9.8 (critical), 2024-12-10: Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0…
• CVE-2024-12393 - CVSS 5.4 (medium), 2024-12-10: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting…
• CVE-2024-55636 - CVSS 9.8 (critical), 2024-12-10: Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0…
• CVE-2024-55635 - CVSS 6.1 (medium), 2024-12-10: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting…
• CVE-2024-55638 - CVSS 9.8 (critical), 2024-12-10: Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0…
• CVE-2024-11942 - CVSS 5.9 (medium), 2024-12-05: A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.
• CVE-2024-11941 - CVSS 7.5 (high), 2024-12-05: A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.
• CVE-2024-45440 - CVSS 5.3 (medium), 2024-08-29: core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file…
• CVE-2024-22362 - CVSS 7.5 (high), 2024-01-16: Drupal contains a vulnerability with improper handling of structural elements. If this vulnerability is exploited, an attacker may be able to cause a…
• CVE-2023-5256 - CVSS 7.5 (high), 2023-09-28: In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and…
• CVE-2023-31250 - CVSS 6.5 (medium), 2023-04-26: The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they…
• CVE-2022-25276 - CVSS 6.1 (medium), 2023-04-26: The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain.…
• CVE-2022-25278 - CVSS 6.5 (medium), 2023-04-26: Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should…
• CVE-2022-25277 - CVSS 7.2 (high), 2023-04-26: Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to…
• CVE-2022-25273 - CVSS 7.5 (high), 2023-04-26: Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow…
• CVE-2022-25275 - CVSS 7.5 (high), 2023-04-26: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating…
• CVE-2022-25274 - CVSS 5.4 (medium), 2023-04-26: Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting…
• CVE-2022-39261 - CVSS 7.5 (high), 2022-09-28: Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader…
• CVE-2022-31042 - CVSS 7.5 (high), 2022-06-10: Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the…
• CVE-2022-31043 - CVSS 7.5 (high), 2022-06-10: Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the…
• CVE-2022-29248 - CVSS 8.1 (high), 2022-05-25: Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not…
• CVE-2022-24775 - CVSS 7.5 (high), 2022-03-21: guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new…
• CVE-2022-24729 - CVSS 7.5 (high), 2022-03-16: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The…
• CVE-2022-24728 - CVSS 5.4 (medium), 2022-03-16: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect…
• CVE-2022-25270 - CVSS 6.5 (medium), 2022-02-17: The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission…
• CVE-2022-25271 - CVSS 7.5 (high), 2022-02-16: Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow…
• CVE-2020-13669 - CVSS 6.1 (medium), 2022-02-11: Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to…
• CVE-2020-13674 - CVSS 6.5 (medium), 2022-02-11: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible…
• CVE-2020-13677 - CVSS 7.5 (high), 2022-02-11: Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass.…
• CVE-2020-13668 - CVSS 6.1 (medium), 2022-02-11: Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the…
• CVE-2020-13672 - CVSS 6.1 (medium), 2022-02-11: Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This…
• CVE-2020-13676 - CVSS 6.5 (medium), 2022-02-11: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only…
• CVE-2020-13670 - CVSS 7.5 (high), 2022-02-11: Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that…
• CVE-2020-13675 - CVSS 9.8 (critical), 2022-02-11: Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an…
• CVE-2021-41165 - CVSS 8.2 (high), 2021-11-17: CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all…
• CVE-2021-41164 - CVSS 8.2 (high), 2021-11-17: CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may…
• CVE-2021-41184 - CVSS 6.5 (medium), 2021-10-26: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from…
• CVE-2021-41183 - CVSS 6.5 (medium), 2021-10-26: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from…
• CVE-2021-41182 - CVSS 6.5 (medium), 2021-10-26: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from…
• CVE-2020-13663 - CVSS 8.8 (high), 2021-06-11: Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other…
• CVE-2020-13688 - CVSS 6.1 (medium), 2021-06-11: Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the…
• CVE-2021-33829 - CVSS 6.1 (medium), 2021-06-09: A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject…
• CVE-2020-13667 - CVSS 5.3 (medium), 2021-05-17: Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't…
• CVE-2020-13662 - CVSS 6.1 (medium), 2021-05-05: Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary…
• CVE-2020-13665 - CVSS 9.8 (critical), 2021-05-05: Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under…
• CVE-2020-13664 - CVSS 8.8 (high), 2021-05-05: Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site…
• CVE-2020-13666 - CVSS 6.1 (medium), 2021-05-05: Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal…
• CVE-2020-36193 - CVSS 7.5 (high), 2021-01-18: Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to…
• CVE-2020-13671 - CVSS 8.8 (high), 2020-11-20: Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as…
• CVE-2020-28949 - CVSS 7.8 (high), 2020-11-19: Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite…
• CVE-2020-28948 - CVSS 7.8 (high), 2020-11-19: Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
• CVE-2019-6342 - CVSS 9.8 (critical), 2020-05-28: An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces…
• CVE-2020-11022 - CVSS 6.9 (medium), 2020-04-29: In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods…
• CVE-2020-11023 - CVSS 6.9 (medium), 2020-04-29: In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing…
• CVE-2020-9281 - CVSS 6.1 (medium), 2020-03-07: A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script…
• CVE-2011-2715 - CVSS 9.8 (critical), 2020-01-14: An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names.
• CVE-2011-2714 - CVSS 6.1 (medium), 2020-01-14: A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or…
• CVE-2011-2726 - CVSS 7.5 (high), 2019-11-15: An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the…
• CVE-2010-2473 - CVSS 6.5 (medium), 2019-11-07: Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user with an open session that was blocked…
• CVE-2010-2472 - CVSS 4.8 (medium), 2019-11-07: Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native…
• CVE-2010-2250 - CVSS 6.1 (medium), 2019-11-07: Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a…
• CVE-2010-2471 - CVSS 6.1 (medium), 2019-11-06: Drupal versions 5.x and 6.x has open redirection
• CVE-2019-11876 - CVSS 6.1 (medium), 2019-05-24: In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a…
• CVE-2019-10910 - CVSS 9.8 (critical), 2019-05-16: In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could…
• CVE-2019-10909 - CVSS 5.4 (medium), 2019-05-16: In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can…
• CVE-2019-10911 - CVSS 7.5 (high), 2019-05-16: In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to…
• CVE-2019-11831 - CVSS 9.8 (critical), 2019-05-09: The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows…
• CVE-2019-11358 - CVSS 6.1 (medium), 2019-04-20: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an…
• CVE-2019-6341 - CVSS 5.4 (medium), 2019-03-26: In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File…
• CVE-2019-6340 - CVSS 8.1 (high), 2019-02-21: Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary…
• CVE-2017-6923 - CVSS 6.5 (medium), 2019-01-22: In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module…
• CVE-2017-6922 - CVSS 6.5 (medium), 2019-01-22: In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached…
• CVE-2019-6339 - CVSS 9.8 (critical), 2019-01-22: In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar…
• CVE-2019-6338 - CVSS 8 (high), 2019-01-22: In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This…
• CVE-2017-6921 - CVSS 5.9 (medium), 2019-01-15: In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site…
• CVE-2017-6924 - CVSS 7.4 (high), 2019-01-15: In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does…
• CVE-2017-6925 - CVSS 9.8 (critical), 2019-01-15: In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or…
• CVE-2017-6920 - CVSS 9.8 (critical), 2018-08-06: Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during…
• CVE-2018-14773 - CVSS 6.5 (medium), 2018-08-03: An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through…
• CVE-2018-7602 - CVSS 9.8 (critical), 2018-07-19: A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack…