Drupal
Page 3 of 12 — Drupal CVEs from a corpus of 1185, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48446 | High | 8.8 | 2025-06-11 | Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0… |
CVE-2025-48445 | High | 8.8 | 2025-06-11 | Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from… |
CVE-2025-48444 | Medium | 5.3 | 2025-06-11 | Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0. |
CVE-2025-48013 | Medium | 5.3 | 2025-06-11 | Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0. |
CVE-2025-4416 | High | 7.5 | 2025-05-21 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track… |
CVE-2025-4415 | Medium | 4.8 | 2025-05-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This i… |
CVE-2025-48012 | Medium | 4.8 | 2025-05-21 | Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Pa… |
CVE-2025-48011 | Medium | 4.8 | 2025-05-21 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Pass… |
CVE-2025-48010 | Medium | 4.8 | 2025-05-21 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Pass… |
CVE-2025-48009 | Low | 3.1 | 2025-05-21 | Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12. |
CVE-2025-47710 | High | 7.4 | 2025-05-14 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affect… |
CVE-2025-47709 | Medium | 6.5 | 2025-05-14 | Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from… |
CVE-2025-47708 | High | 8.8 | 2025-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA -… |
CVE-2025-47707 | High | 7.5 | 2025-05-14 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affect… |
CVE-2025-47706 | Medium | 4.8 | 2025-05-14 | Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affec… |
CVE-2025-47705 | Medium | 6.1 | 2025-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal IFrame Remove Filter allows Cross-Site Scripting (… |
CVE-2025-47704 | Medium | 6.1 | 2025-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Sit… |
CVE-2025-47703 | Medium | 6.1 | 2025-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scrip… |
CVE-2025-47702 | Medium | 6.1 | 2025-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal oEmbed Providers allows Cross-Site Scripting (XSS)… |
CVE-2025-47701 | High | 8.8 | 2025-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site Request Forgery.This issue affects Restrict route by IP: from… |
CVE-2025-3907 | Medium | 4.3 | 2025-04-23 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 befo… |
CVE-2025-3904 | High | 7.3 | 2025-04-23 | Vulnerability in Drupal Sportsleague.This issue affects Sportsleague: *.*. |
CVE-2025-3903 | High | 7.3 | 2025-04-23 | Vulnerability in Drupal UEditor - 百度编辑器.This issue affects UEditor - 百度编辑器: *.*. |
CVE-2025-3902 | Medium | 6.1 | 2025-04-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Class allows Cross-Site Scripting (XSS).This… |
CVE-2025-3901 | Medium | 6.1 | 2025-04-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Bootstrap Site Alert allows Cross-Site Scripting (… |
CVE-2025-3900 | Medium | 6.1 | 2025-04-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS).This is… |
CVE-2025-3739 | Medium | 5.9 | 2025-04-16 | Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.This issue affects Drupal 8 Google Optimize Hide Page: *.*. |
CVE-2025-3738 | Medium | 5.9 | 2025-04-16 | Vulnerability in Drupal Google Optimize.This issue affects Google Optimize: *.*. |
CVE-2025-3737 | Medium | 5.9 | 2025-04-16 | Vulnerability in Drupal Google Maps: Store Locator.This issue affects Google Maps: Store Locator: *.*. |
CVE-2025-3736 | Medium | 5.9 | 2025-04-16 | Vulnerability in Drupal Simple GTM.This issue affects Simple GTM: *.*. |
CVE-2025-3735 | Medium | 5.9 | 2025-04-16 | Vulnerability in Drupal Panelizer (obsolete).This issue affects Panelizer (obsolete): *.*. |
CVE-2025-3734 | Medium | 5.9 | 2025-04-16 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 b… |
CVE-2025-3733 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal baguetteBox.Js allows Cross-Site Scripting (XSS).T… |
CVE-2025-3475 | Medium | 6.5 | 2025-04-09 | Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This… |
CVE-2025-3474 | Medium | 6.5 | 2025-04-09 | Missing Authentication for Critical Function vulnerability in Drupal Panels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-3131 | Medium | 5.4 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Con… |
CVE-2025-3130 | Medium | 5.4 | 2025-04-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.This issue affects Obf… |
CVE-2025-3129 | Medium | 4.8 | 2025-04-02 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 bef… |
CVE-2025-3062 | Medium | 6.6 | 2025-03-31 | Vulnerability in Drupal Drupal Admin LTE theme.This issue affects Drupal Admin LTE theme: *.*. |
CVE-2025-3061 | Medium | 6.6 | 2025-03-31 | Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*. |
CVE-2025-3060 | Medium | 6.6 | 2025-03-31 | Vulnerability in Drupal Flattern – Multipurpose Bootstrap Business Profile.This issue affects Flattern – Multipurpose Bootstrap Business Profile: *.*. |
CVE-2025-3059 | Medium | 5.3 | 2025-03-31 | Vulnerability in Drupal Profile Private.This issue affects Profile Private: *.*. |
CVE-2025-3057 | Medium | 6.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This… |
CVE-2025-31697 | Medium | 6.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Formatter Suite allows Cross-Site Scripting (XSS)… |
CVE-2025-31696 | Medium | 6.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal RapiDoc OAS Field Formatter allows Cross-Site Scri… |
CVE-2025-31695 | Medium | 6.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Link field display mode formatter allows Cross-Sit… |
CVE-2025-31694 | High | 8.1 | 2025-03-31 | Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): fr… |
CVE-2025-31693 | Medium | 6.6 | 2025-03-31 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Comma… |
CVE-2025-31692 | High | 7.5 | 2025-03-31 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Comma… |
CVE-2025-31691 | Critical | 9.8 | 2025-03-31 | Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0. |
CVE-2025-31690 | High | 8.8 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1… |
CVE-2025-31689 | High | 8.1 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data… |
CVE-2025-31688 | Medium | 6.8 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0… |
CVE-2025-31687 | Medium | 6.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS)… |
CVE-2025-31686 | High | 8.1 | 2025-03-31 | Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 befor… |
CVE-2025-31685 | Critical | 9.1 | 2025-03-31 | Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 befor… |
CVE-2025-31684 | Medium | 6.8 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4… |
CVE-2025-31683 | Medium | 6.8 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0… |
CVE-2025-31682 | Medium | 4.8 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This… |
CVE-2025-31681 | Critical | 9.8 | 2025-03-31 | Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6. |
CVE-2025-31680 | Medium | 6.8 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 be… |
CVE-2025-31679 | Medium | 6.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (… |
CVE-2025-31678 | High | 8.2 | 2025-03-31 | Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0… |
CVE-2025-31677 | High | 8.8 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Inte… |
CVE-2025-31676 | High | 8.8 | 2025-03-31 | Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3. |
CVE-2025-31675 | Medium | 5.4 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This… |
CVE-2025-31674 | High | 7.5 | 2025-03-31 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects D… |
CVE-2025-31673 | Medium | 4.6 | 2025-03-31 | Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 bef… |
CVE-2024-13312 | Medium | 5.3 | 2025-01-09 | Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 befo… |
CVE-2024-13311 | High | 7.3 | 2025-01-09 | Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*. |
CVE-2024-13310 | Medium | 6.5 | 2025-01-09 | Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: *.*. |
CVE-2024-13309 | Medium | 5.4 | 2025-01-09 | Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login… |
CVE-2024-13308 | Low | 3.8 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (X… |
CVE-2024-13305 | Medium | 4.8 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS… |
CVE-2024-13304 | Medium | 4.5 | 2025-01-09 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3. |
CVE-2024-13303 | Medium | 5.3 | 2025-01-09 | Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2. |
CVE-2024-13302 | Medium | 5.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 befor… |
CVE-2024-13301 | Medium | 6.1 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth… |
CVE-2024-13300 | Medium | 6.6 | 2025-01-09 | Vulnerability in Drupal Print Anything.This issue affects Print Anything: *.*. |
CVE-2024-13299 | Medium | 6.6 | 2025-01-09 | Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*. |
CVE-2024-13298 | Medium | 4.8 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS)… |
CVE-2024-13297 | Medium | 6.6 | 2025-01-09 | Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15. |
CVE-2024-13296 | Medium | 6.6 | 2025-01-09 | Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1. |
CVE-2024-13295 | Medium | 6.6 | 2025-01-09 | Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3. |
CVE-2024-13294 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This i… |
CVE-2024-13293 | Low | 3.1 | 2025-01-09 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2. |
CVE-2024-13292 | Medium | 4.8 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tooltip allows Cross-Site Scripting (XSS).This iss… |
CVE-2024-13291 | High | 7.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 b… |
CVE-2024-13290 | Medium | 5.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4. |
CVE-2024-13289 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting (XSS)… |
CVE-2024-13288 | Medium | 4.3 | 2025-01-09 | Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from… |
CVE-2024-13287 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (X… |
CVE-2024-13286 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SVG Embed allows Cross-Site Scripting (XSS).This i… |
CVE-2024-13285 | Critical | 9.8 | 2025-01-09 | Vulnerability in Drupal wkhtmltopdf.This issue affects wkhtmltopdf: *.*. |
CVE-2024-13284 | High | 8.8 | 2025-01-09 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, f… |
CVE-2024-13283 | Medium | 6.1 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issu… |
CVE-2024-13282 | High | 8.8 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0. |
CVE-2024-13281 | Critical | 9.1 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2. |
CVE-2024-13280 | Critical | 9.8 | 2025-01-09 | Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0… |
CVE-2024-13279 | Critical | 9.8 | 2025-01-09 | Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0… |