Drupal Core (Drupal) - vulnerabilities (CVEs)

49 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2026-08-25. Vendor: Drupal.

CVEs of Drupal Core

CVE-2026-15916 - CVSS 4.2 (medium), 2026-08-25: Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from…
CVE-2026-15917 - CVSS 4.7 (medium), 2026-08-25: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).…
CVE-2026-55805 - CVSS 5.4 (medium), 2026-08-25: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects…
CVE-2026-55808 - CVSS 5.4 (medium), 2026-07-10: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).…
CVE-2026-55807 - CVSS 3.1 (low), 2026-07-10: Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0…
CVE-2026-55806 - CVSS 5.9 (medium), 2026-07-10: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from…
CVE-2026-55804 - CVSS 5.9 (medium), 2026-07-10: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects…
CVE-2026-55803 - CVSS 5.9 (medium), 2026-07-10: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects…
CVE-2026-9082 - CVSS 9.8 (critical), 2026-05-20: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue…
CVE-2026-6366 - CVSS 6.6 (medium), 2026-05-19: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects…
CVE-2026-6365 - CVSS 6.1 (medium), 2026-05-19: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).…
CVE-2026-6367 - CVSS 6.1 (medium), 2026-05-19: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).…
CVE-2025-13082 - CVSS 4.3 (medium), 2025-11-18: User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from…
CVE-2025-13083 - CVSS 3.7 (low), 2025-11-18: Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security…
CVE-2025-13081 - CVSS 5.9 (medium), 2025-11-18: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects…
CVE-2025-13080 - CVSS 5.3 (medium), 2025-11-18: Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0…
CVE-2025-3057 - CVSS 6.1 (medium), 2025-03-31: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting…
CVE-2025-31675 - CVSS 5.4 (medium), 2025-03-31: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting…
CVE-2025-31674 - CVSS 7.5 (high), 2025-03-31: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects…
CVE-2025-31673 - CVSS 4.6 (medium), 2025-03-31: Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0…
CVE-2024-55635 - CVSS 6.1 (medium), 2024-12-10: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting…
CVE-2024-55638 - CVSS 9.8 (critical), 2024-12-10: Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0…
CVE-2024-55634 - CVSS 8.1 (high), 2024-12-10: A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0…
CVE-2024-55637 - CVSS 9.8 (critical), 2024-12-10: Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0…
CVE-2024-12393 - CVSS 5.4 (medium), 2024-12-10: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting…
CVE-2024-55636 - CVSS 9.8 (critical), 2024-12-10: Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0…
CVE-2024-11942 - CVSS 5.9 (medium), 2024-12-05: A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.
CVE-2024-11941 - CVSS 7.5 (high), 2024-12-05: A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.
CVE-2024-45440 - CVSS 5.3 (medium), 2024-08-29: core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file…
CVE-2020-13663 - CVSS 8.8 (high), 2021-06-11: Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other…
CVE-2020-13688 - CVSS 6.1 (medium), 2021-06-11: Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the…
CVE-2020-13667 - CVSS 5.3 (medium), 2021-05-17: Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't…
CVE-2020-13664 - CVSS 8.8 (high), 2021-05-05: Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site…
CVE-2020-13662 - CVSS 6.1 (medium), 2021-05-05: Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary…
CVE-2020-13665 - CVSS 9.8 (critical), 2021-05-05: Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under…
CVE-2020-13666 - CVSS 6.1 (medium), 2021-05-05: Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal…
CVE-2020-13671 - CVSS 8.8 (high), 2020-11-20: Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as…
CVE-2019-6342 - CVSS 9.8 (critical), 2020-05-28: An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces…
CVE-2019-6341 - CVSS 5.4 (medium), 2019-03-26: In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File…
CVE-2019-6340 - CVSS 8.1 (high), 2019-02-21: Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary…
CVE-2017-6922 - CVSS 6.5 (medium), 2019-01-22: In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached…
CVE-2019-6339 - CVSS 9.8 (critical), 2019-01-22: In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar…
CVE-2017-6923 - CVSS 6.5 (medium), 2019-01-22: In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module…
CVE-2019-6338 - CVSS 8 (high), 2019-01-22: In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This…
CVE-2017-6921 - CVSS 5.9 (medium), 2019-01-15: In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site…
CVE-2017-6924 - CVSS 7.4 (high), 2019-01-15: In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does…
CVE-2017-6381 - CVSS 8.1 (high), 2017-03-16: A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default…
CVE-2017-6379 - CVSS 7.5 (high), 2017-03-16: Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site.…
CVE-2017-6377 - CVSS 7.5 (high), 2017-03-16: When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in…