.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

drupal/core 11.3.14 vulnerabilities

150 advisories known · drupal/core@11.3.14 · 4 affect this release · Dependencies not checked · showing first 100

SEVERITYADVISORYPUBLISHED

Affects 11.3.14

SEVERITYADVISORYPUBLISHED

UnknownNo summary availableDRUPAL-CORE-2026-016CVE-2026-108514Affected >=10.3.0 <10.6.19, >=11.0.0 <11.3.19, >=11.4.0 <11.4.10, >=12.0.0-alpha1 <12.0.0-beta2Fixed in 10.6.19 Fixed in 11.3.19 Fixed in 11.4.10 Fixed in 12.0.0-beta2OSV source ↗27 days ago

UnknownNo summary availableDRUPAL-CORE-2026-015CVE-2026-108515Affected >=11.0.0 <11.3.19, >=11.4.0 <11.4.10, >=12.0.0-alpha1 <12.0.0-beta2, >=8.9.0 <10.6.19Fixed in 10.6.19 Fixed in 11.3.19 Fixed in 11.4.10 Fixed in 12.0.0-beta2OSV source ↗27 days ago

UnknownNo summary availableDRUPAL-CORE-2026-014CVE-2026-108097Affected >=11.0.0 <11.3.19, >=11.4.0 <11.4.10, >=12.0.0-alpha1 <12.0.0-beta2, >=8.9.0 <10.6.19Fixed in 10.6.19 Fixed in 11.3.19 Fixed in 11.4.10 Fixed in 12.0.0-beta2OSV source ↗27 days ago

UnknownNo summary availableDRUPAL-CORE-2026-013Affected >=10.5.0 <10.6.17, >=11.0.0 <11.3.17, >=11.4.0 <11.4.7Fixed in 10.6.17 Fixed in 11.3.17 Fixed in 11.4.7OSV source ↗2 months ago

Does not affect 11.3.14

SEVERITYADVISORYPUBLISHED

CriticalDrupal Core has a SQL Injection issueGHSA-ghwc-95x2-682jBIT-drupal-2026-9082CVE-2026-9082DRUPAL-CORE-2026-004Affected >=10.5.0 <10.5.10, >=10.6.0 <10.6.9, >=11.0.0 <11.1.10, >=11.2.0 <11.2.12, >=11.3.0 <11.3.10, >=8.9.0 <10.4.10Fixed in 10.4.10 Fixed in 10.5.10 Fixed in 10.6.9 Fixed in 11.1.10 Fixed in 11.2.12 Fixed in 11.3.10OSV source ↗6 months ago

CriticalDrupal core contains a potential PHP Object Injection vulnerabilityGHSA-938f-5r4f-h65vBIT-drupal-2024-55636CVE-2024-55636DRUPAL-CORE-2024-006Affected >=10.3.0 <10.3.9, >=11.0.0 <11.0.8, >=8.0.0 <10.2.11Fixed in 10.2.11 Fixed in 10.3.9 Fixed in 11.0.8OSV source ↗2 years ago

CriticalDrupal core contains a potential PHP Object Injection vulnerabilityGHSA-gvf2-2f4g-jqf4BIT-drupal-2024-55638CVE-2024-55638DRUPAL-CORE-2024-008Affected >=10.3.0 <10.3.9, >=7.0 <7.102, >=8.0.0 <10.2.11Fixed in 10.2.11 Fixed in 10.3.9 Fixed in 7.102OSV source ↗2 years ago

CriticalDrupal core contains a potential PHP Object Injection vulnerabilityGHSA-w6rx-9g2x-mg5gBIT-drupal-2024-55637CVE-2024-55637DRUPAL-CORE-2024-007Affected >=10.3.0 <10.3.9, >=11.0.0 <11.0.8, >=8.0.0 <10.2.11Fixed in 10.2.11 Fixed in 10.3.9 Fixed in 11.0.8OSV source ↗2 years ago

CriticalDrupal Core Remote Code Execution VulnerabilityGHSA-297x-j9pm-xjggCVE-2018-7602DRUPAL-CORE-2018-004Affected >=7.0 <7.59, >=8.0 <8.4.8, >=8.5 <8.5.3, 8.0.0-beta6 - 8.0.0-rc4, 8.5.0-alpha1 - 8.5.0-rc1Fixed in 7.59 Fixed in 8.4.8 Fixed in 8.5.3OSV source ↗3 years ago

CriticalDrupal Improper Access ControlGHSA-xq62-62c9-22mgCVE-2019-6342DRUPAL-CORE-2019-008Affected >=8.7.4 <8.7.5Fixed in 8.7.5OSV source ↗3 years ago

CriticalDrupal Core Access bypass vulnerabilityGHSA-wxqp-jwc9-g39xBIT-drupal-2020-13665CVE-2020-13665Affected >=8.8.0 <8.8.8, >=8.9.0 <8.9.1, >=9.0.0 <9.0.1Fixed in 8.8.8 Fixed in 8.9.1 Fixed in 9.0.1OSV source ↗4 years ago

CriticalDrupal PECL YAML parser unsafe object handlingGHSA-9c24-g32g-35rjCVE-2017-6920Affected >=8.0 <8.3.4, 8.0.0-beta6 - 8.0.0-rc4Fixed in 8.3.4OSV source ↗4 years ago

CriticalDrupal Core Remote Code Execution VulnerabilityGHSA-7fh9-933g-885pCVE-2018-7600DRUPAL-CORE-2018-002Affected >=7.0 <7.58, >=8.0 <8.3.9, >=8.4.0 <8.4.6, >=8.5.0 <8.5.1, 8.0.0-beta6 - 8.0.0-rc4Fixed in 7.58 Fixed in 8.3.9 Fixed in 8.4.6 Fixed in 8.5.1OSV source ↗4 years ago

CriticalDrupal Entity access bypass for entities that do not have UUIDs or have protected revisionsGHSA-f4qx-jqfq-7785CVE-2017-6925Affected >=8.0 <8.3.7, 8.0.0-beta6 - 8.0.0-rc4Fixed in 8.3.7OSV source ↗5 years ago

CriticalDrupal SQL Injection vulnerabilityGHSA-hcq9-hmgf-6qr9CVE-2011-2715Affected ==6.20OSV source ↗5 years ago

CriticalUnrestricted Upload of File with Dangerous Type in Drupal coreGHSA-v8wr-r69p-mmwxBIT-drupal-2020-13675CVE-2020-13675DRUPAL-CONTRIB-2021-029DRUPAL-CORE-2021-008Affected >=8.0.0 <8.9.19, >=9.1.0 <9.1.13, >=9.2.0 <9.2.6Fixed in 8.9.19 Fixed in 9.1.13 Fixed in 9.2.6OSV source ↗5 years ago

CriticalArbitrary PHP code execution in DrupalGHSA-8cw5-rv98-5c46CVE-2019-6339DRUPAL-CORE-2019-002Affected >=7.0.0 <7.62.0, >=8.0.0 <8.5.9, >=8.6.0 <8.6.6Fixed in 7.62.0 Fixed in 8.5.9 Fixed in 8.6.6OSV source ↗5 years ago

CriticalDirectory Traversal in typo3/phar-stream-wrapperGHSA-xv7v-rf6g-xwrcCVE-2019-11831DRUPAL-CORE-2019-007Affected >=7.0.0 <7.67.0, >=8.0.0 <8.6.16, >=8.7.0 <8.7.1Fixed in 7.67.0 Fixed in 8.6.16 Fixed in 8.7.1OSV source ↗8 years ago

CriticalDrupal Core Insufficient Contextual Links validation leads to Remote Code ExecutionGHSA-7v68-3pr5-h3crAffected >=8.0.0 <8.5.8, >=8.6.0 <8.6.2Fixed in 8.5.8 Fixed in 8.6.2OSV source ↗2 years ago

CriticalDrupal core Remote Code ExecutionGHSA-6mgp-v5cm-ghg5Affected >=7.0 <7.60, >=8.0.0 <8.5.8, >=8.6.0 <8.6.2Fixed in 7.60 Fixed in 8.5.8 Fixed in 8.6.2OSV source ↗2 years ago

CriticalCache poisoning in drupal/coreGHSA-rjqg-3h9m-fx5xBIT-drupal-2023-5256CVE-2023-5256DRUPAL-CORE-2023-006Affected >=10.0.0 <10.0.11, >=10.1.0 <10.1.4, >=8.7.0 <9.5.11Fixed in 10.0.11 Fixed in 10.1.4 Fixed in 9.5.11OSV source ↗3 years ago

CriticalAccess bypass in Drupal coreGHSA-8849-cv9f-vccmBIT-drupal-2023-31250CVE-2023-31250DRUPAL-CORE-2023-005Affected >=10.0.0 <10.0.8, >=7.0.0 <7.96, >=8.0.0 <9.4.14, >=9.5.0 <9.5.8Fixed in 10.0.8 Fixed in 7.96 Fixed in 9.4.14 Fixed in 9.5.8OSV source ↗4 years ago

HighDrupal Saving user accounts can sometimes grant the user all rolesGHSA-frqf-9qr4-6vxfCVE-2016-6211Affected >=7.0 <7.44Fixed in 7.44OSV source ↗4 years ago

HighDrupal core Unrestricted Upload of File with Dangerous TypeGHSA-68jc-v27h-vhmwBIT-drupal-2020-13671CVE-2020-13671DRUPAL-CORE-2020-012Affected >=7.0.0 <7.74, >=8.0.0 <8.8.11, >=8.9.0 <8.9.9, >=9.0.0 <9.0.8Fixed in 7.74 Fixed in 8.8.11 Fixed in 8.9.9 Fixed in 9.0.8OSV source ↗5 years ago

HighDrupal Core Arbitrary PHP code execution vulnerabilityGHSA-x72f-ggjw-v5xhBIT-drupal-2020-13664CVE-2020-13664DRUPAL-CORE-2020-005Affected >=8.0.0 <8.8.8, >=8.9.0 <8.9.1, >=9.0.0 <9.0.1Fixed in 8.8.8 Fixed in 8.9.1 Fixed in 9.0.1OSV source ↗6 years ago

HighDrupal Core Cross-Site Request Forgery (CSRF) vulnerabilityGHSA-m648-hpf8-qcjwBIT-drupal-2020-13663CVE-2020-13663DRUPAL-CORE-2020-004Affected >=7.0.0 <7.72, >=8.0.0 <8.8.8, >=8.9.0 <8.9.1, >=9.0.0 <9.0.1Fixed in 7.72 Fixed in 8.8.8 Fixed in 8.9.1 Fixed in 9.0.1OSV source ↗6 years ago

HighDrupal core Multiple vulnerabilities due to the use of the third-party library Archive_TarGHSA-98h9-727m-44qvAffected >=7.0.0 <7.69, >=8.0.0 <8.7.11, >=8.8.0 <8.8.1Fixed in 7.69 Fixed in 8.7.11 Fixed in 8.8.1OSV source ↗2 years ago

HighDrupal saving user accounts can sometimes grant the user all rolesGHSA-q3p9-8728-wq7xCVE-2016-3169Affected >=6.0 <6.38, >=7.0 <7.43Fixed in 6.38 Fixed in 7.43OSV source ↗4 years ago

HighDrupal File upload access bypass and denial of serviceGHSA-w2pj-c8x5-jvg2CVE-2016-3162Affected >=7.0 <7.43, >=8.0 <8.0.4, 8.0.0-beta6 - 8.0.0-rc4Fixed in 7.43 Fixed in 8.0.4OSV source ↗4 years ago

HighDrupal arbitrary code executionGHSA-69g8-g9jq-74v7CVE-2016-3171Affected >=6.0 <6.38Fixed in 6.38OSV source ↗4 years ago

HighDrupal Comment reply form allows access to restricted contentGHSA-2p28-5mvp-2j2rCVE-2017-6926Affected >=7.0 <7.57, >=8.4.0 <8.4.5Fixed in 7.57 Fixed in 8.4.5OSV source ↗4 years ago

HighDrupal access bypass vulnerabilityGHSA-3327-jr93-7hq3CVE-2017-6930Affected >=8.4.0 <8.4.5Fixed in 8.4.5OSV source ↗5 years ago

HighDrupal Remote code executionGHSA-rhx9-3qf7-r3j7CVE-2017-6381Affected >=8.0 <8.2.7, 8.0.0-beta6 - 8.0.0-rc4Fixed in 8.2.7OSV source ↗5 years ago

HighDrupal Core Remote Code Execution VulnerabilityGHSA-3gx6-h57h-rm27CVE-2019-6340DRUPAL-CORE-2019-003Affected >=7.0.0 <7.62.0, >=8.0.0 <8.5.11, >=8.6.0 <8.6.10Fixed in 7.62.0 Fixed in 8.5.11 Fixed in 8.6.10OSV source ↗5 years ago

HighHTTP Proxy header vulnerabilityGHSA-m6ch-gg5f-wxx3CVE-2016-5385Affected >=8.0 <8.1.7, 8.0.0-beta6 - 8.0.0-rc4Fixed in 8.1.7OSV source ↗5 years ago

HighDrupal Access Control BypassGHSA-96vx-qf28-6f8mCVE-2011-2687Affected >=7.0 <7.3Fixed in 7.3OSV source ↗4 years ago

HighDrupal core Arbitrary PHP code executionGHSA-gxxj-g9v8-w28pAffected >=7.0.0 <7.75, >=8.0.0 <8.8.12, >=8.9.0 <8.9.10, >=9.0.0 <9.0.9Fixed in 7.75 Fixed in 8.8.12 Fixed in 8.9.10 Fixed in 9.0.9OSV source ↗2 years ago

HighDrupal core Denial of ServiceGHSA-xq54-x54m-vcpxBIT-drupal-2024-11941CVE-2024-11941DRUPAL-CORE-2024-001Affected >=10.2.0 <10.2.2, >=8.0.0 <10.1.8Fixed in 10.1.8 Fixed in 10.2.2OSV source ↗2 years ago

HighDrupal core Information Disclosure vulnerabilityGHSA-xh3v-6f9j-wxw3BIT-drupal-2022-25275CVE-2022-25275DRUPAL-CORE-2022-012Affected >=7.0.0 <7.91, >=8.0.0 <9.3.19, >=9.4.0 <9.4.3Fixed in 7.91 Fixed in 9.3.19 Fixed in 9.4.3OSV source ↗4 years ago

HighDrupal Form API ignores access restrictions on submit buttonsGHSA-4gh5-3hqj-x3pjCVE-2016-3165Affected >=6.0 <6.38Fixed in 6.38OSV source ↗4 years ago

HighDrupal Brute force amplification attacks via XML-RPCGHSA-h3r9-pjmr-f938CVE-2016-3163Affected >=6.0 <6.38, >=7.0 <7.43Fixed in 6.38 Fixed in 7.43OSV source ↗4 years ago

HighDrupal Incorrect cache context on password reset pageGHSA-98w5-wqp9-w466CVE-2016-9450Affected >=8.0 <8.2.3, 8.0.0-beta6 - 8.0.0-rc4Fixed in 8.2.3OSV source ↗4 years ago

HighDrupal Cross-Site Request Forgery (CSRF)GHSA-gxxq-fhc7-3jv9CVE-2017-6379Affected >=8.2.0 <8.2.7Fixed in 8.2.7OSV source ↗4 years ago

HighDrupal access control bypass vulnerabilityGHSA-6hpj-9xj7-2jxxCVE-2017-6919Affected >=8.0 <8.2.8, >=8.3.0 <8.3.1, 8.0.0-beta6 - 8.0.0-rc4Fixed in 8.2.8 Fixed in 8.3.1OSV source ↗5 years ago

HighDrupal editor module incorrectly checks access to inline private filesGHSA-w7qx-vwr9-2j3rCVE-2017-6377Affected >=8.2.0 <8.2.7Fixed in 8.2.7OSV source ↗5 years ago

HighImproper input validation in Drupal coreGHSA-g36h-4jr6-qmm9BIT-drupal-2022-25273CVE-2022-25273DRUPAL-CORE-2022-008Affected >=8.0.0 <9.2.18, >=9.3.0 <9.3.12Fixed in 9.2.18 Fixed in 9.3.12OSV source ↗5 years ago

HighImproper input validation in Drupal coreGHSA-fmfv-x8mp-5767BIT-drupal-2022-25271CVE-2022-25271DRUPAL-CORE-2022-003Affected >=7.0.0 <7.88, >=8.0.0 <9.2.13, >=9.3.0 <9.3.6Fixed in 7.88 Fixed in 9.2.13 Fixed in 9.3.6OSV source ↗5 years ago

HighExposure of Resource to Wrong Sphere in Drupal CoreGHSA-mmjr-5q74-p3m4BIT-drupal-2020-13670CVE-2020-13670DRUPAL-CORE-2020-011Affected >=8.0.0 <8.8.10, >=8.9.0 <8.9.6, >=9.0.0 <9.0.6Fixed in 8.8.10 Fixed in 8.9.6 Fixed in 9.0.6OSV source ↗5 years ago

HighDrupal core access bypass vulnerabilityGHSA-3xr3-phjp-g6p2BIT-drupal-2020-13677CVE-2020-13677DRUPAL-CORE-2021-010Affected >=8.0.0 <8.9.19, >=9.1.0 <9.1.13, >=9.2.0 <9.2.6Fixed in 8.9.19 Fixed in 9.1.13 Fixed in 9.2.6OSV source ↗5 years ago

HighDrupal Open RedirectGHSA-836p-6p4j-35cgCVE-2016-3164Affected >=6.0 <6.38, >=7.0 <7.43, >=8.0 <8.0.4, 8.0.0-beta6 - 8.0.0-rc4Fixed in 6.38 Fixed in 7.43 Fixed in 8.0.4OSV source ↗4 years ago

HighDrupal Open redirect vulnerability in the drupal_goto functionGHSA-gxwx-c7m8-f95hCVE-2016-3167Affected >=6.0 <6.38Fixed in 6.38OSV source ↗4 years ago

HighDrupal REST API can bypass comment approvalGHSA-p8g6-5mg7-9r5qCVE-2017-6924Affected >=8.0 <8.3.7, 8.0.0-beta6 - 8.0.0-rc4Fixed in 8.3.7OSV source ↗5 years ago

HighDrupal core arbitrary PHP code executionGHSA-6955-67hm-vjjqBIT-drupal-2022-25277CVE-2022-25277DRUPAL-CORE-2022-014Affected >=8.0.0 <9.3.19, >=9.4.0 <9.4.3Fixed in 9.3.19 Fixed in 9.4.3OSV source ↗4 years ago

MediumDrupal Open RedirectGHSA-66gr-xrcf-8jpqCVE-2016-9451Affected >=7.0 <7.52, >=8.0 <8.2.3, 8.0.0-beta6 - 8.0.0-rc4Fixed in 7.52 Fixed in 8.2.3OSV source ↗4 years ago

MediumDrupal core allows Object InjectionGHSA-xmjc-63pr-2mpgBIT-drupal-2026-6366CVE-2026-6366DRUPAL-CORE-2026-002Affected >=10.6.0 <10.6.7, >=11.0.0 <11.2.11, >=11.3.0 <11.3.7, >=8.0.0 <10.5.9Fixed in 10.5.9 Fixed in 10.6.7 Fixed in 11.2.11 Fixed in 11.3.7OSV source ↗7 months ago

MediumDrupal core unrestricted file uploadGHSA-7gwj-7fhm-vw4wAffected >=8.0.0 <8.7.11, >=8.8.0 <8.8.1Fixed in 8.7.11 Fixed in 8.8.1OSV source ↗2 years ago

MediumAccess bypass in Drupal CoreGHSA-cfh2-7f6h-3m85BIT-drupal-2022-25278CVE-2022-25278DRUPAL-CORE-2022-013Affected >=8.0.0 <9.3.19, >=9.4.0 <9.4.3Fixed in 9.3.19 Fixed in 9.4.3OSV source ↗4 years ago

MediumDrupal Denial of service via transliterate mechanismGHSA-jpj8-49hr-wcwvCVE-2016-9452Affected >=8.0 <8.2.3, 8.0.0-beta6 - 8.0.0-rc4Fixed in 8.2.3OSV source ↗4 years ago

MediumDrupal Settings Tray access bypassGHSA-7ffh-cjvg-fpr4CVE-2017-6931Affected >=8.4.0 <8.4.5Fixed in 8.4.5OSV source ↗5 years ago

MediumDrupal core access bypass vulnerabilityGHSA-58f3-cx8p-h8jgCVE-2017-6922Affected >=7.0 <7.56, >=8.0 <8.3.4, 8.0.0-beta6 - 8.0.0-rc4Fixed in 7.56 Fixed in 8.3.4OSV source ↗5 years ago

MediumIncorrect authorization in Drupal coreGHSA-73q4-j324-2qccBIT-drupal-2022-25270CVE-2022-25270DRUPAL-CORE-2022-004Affected >=8.0.0 <9.2.13, >=9.3.0 <9.3.6Fixed in 9.2.13 Fixed in 9.3.6OSV source ↗5 years ago

MediumCross-Site Request Forgery in Drupal coreGHSA-j586-cj67-vg4pBIT-drupal-2020-13674CVE-2020-13674DRUPAL-CORE-2021-007Affected >=8.0.0 <8.9.19, >=9.1.0 <9.1.13, >=9.2.0 <9.2.6Fixed in 8.9.19 Fixed in 9.1.13 Fixed in 9.2.6OSV source ↗5 years ago

MediumIncorrect Authorization in Drupal coreGHSA-qfhg-m6r8-xxpjBIT-drupal-2020-13676CVE-2020-13676DRUPAL-CORE-2021-009Affected >=8.0.0 <8.9.19, >=9.1.0 <9.1.13, >=9.2.0 <9.2.6Fixed in 8.9.19 Fixed in 9.1.13 Fixed in 9.2.6OSV source ↗5 years ago

MediumMissing Authorization in DrupalGHSA-v3f6-f29f-rgvpCVE-2017-6923Affected >=8.0 <8.3.7, 8.0.0-beta6 - 8.0.0-rc4Fixed in 8.3.7OSV source ↗7 years ago

MediumDrupal Reflected file download vulnerabilityGHSA-qqxc-cppg-4xp8CVE-2016-3168Affected >=6.0 <6.38, >=7.0 <7.43Fixed in 6.38 Fixed in 7.43OSV source ↗4 years ago

MediumDrupal core allows Cross-Site Scripting (XSS)GHSA-pw6f-3999-xp7gBIT-drupal-2026-6367CVE-2026-6367DRUPAL-CORE-2026-003Affected >=11.3.0 <11.3.7Fixed in 11.3.7OSV source ↗7 months ago

MediumDrupal core is Vulnerable to Cross-Site ScriptingGHSA-f3cj-mjqm-fhvjBIT-drupal-2026-6365CVE-2026-6365DRUPAL-CORE-2026-001Affected >=10.6.0 <10.6.7, >=11.0.0 <11.2.11, >=11.3.0 <11.3.7, >=8.0.0 <10.5.9Fixed in 10.5.9 Fixed in 10.6.7 Fixed in 11.2.11 Fixed in 11.3.7OSV source ↗7 months ago

MediumDrupal Core Potential Cross-Site Scripting (XSS) via Error MessagesGHSA-39g6-x4x8-5jcmBIT-drupal-2025-3057CVE-2025-3057DRUPAL-CORE-2025-001Affected >=10.4.0 <10.4.3, >=11.0.0 <11.0.12, >=11.1.0 <11.1.3, >=8.0.0 <10.3.13Fixed in 10.3.13 Fixed in 10.4.3 Fixed in 11.0.12 Fixed in 11.1.3OSV source ↗2 years ago

MediumLack of domain validation in Druple coreGHSA-4wfq-jc9h-vpcxBIT-drupal-2022-25276CVE-2022-25276DRUPAL-CORE-2022-015Affected >=8.0.0 <9.3.19, >=9.4.0 <9.4.3Fixed in 9.3.19 Fixed in 9.4.3OSV source ↗4 years ago

MediumDrupal Core Open Redirect vulnerabilityGHSA-gjqg-9rhv-qj67BIT-drupal-2020-13662CVE-2020-13662Affected >=7.0.0 <7.70Fixed in 7.70OSV source ↗4 years ago

MediumDrupal Cross-site scripting (XSS) vulnerabilityGHSA-vhg8-x858-7wq6CVE-2016-7571Affected >=8.0 <8.1.10, 8.0.0-beta6 - 8.0.0-rc4Fixed in 8.1.10OSV source ↗4 years ago

MediumDrupal cross site scripting vulnerabilityGHSA-5vpr-v24w-mmjjCVE-2017-6929Affected >=7.0 <7.57, >=8.0 <8.4.0, 8.0.0-beta6 - 8.0.0-rc4Fixed in 7.57 Fixed in 8.4.0OSV source ↗4 years ago

MediumDrupal cross-site scripting vulnerabilityGHSA-585j-5449-mf5mCVE-2017-6927Affected >=7.0 <7.57, >=8.4.0 <8.4.5Fixed in 7.57 Fixed in 8.4.5OSV source ↗4 years ago

MediumEnhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)GHSA-g78h-pf65-46rvCVE-2018-9861DRUPAL-CORE-2018-003Affected >=8.0 <8.4.7, >=8.5.0 <8.5.2, 8.0.0-beta6 - 8.0.0-rc4Fixed in 8.4.7 Fixed in 8.5.2OSV source ↗4 years ago

MediumDrupal Cross-Site Scripting vulnerabilityGHSA-qp8q-gwf5-hqh2CVE-2011-2714Affected ==6.20OSV source ↗5 years ago

MediumDrupal core Cross-site Scripting (XSS) vulnerabilityGHSA-3m36-mjwj-352cBIT-drupal-2020-13672CVE-2020-13672DRUPAL-CORE-2021-002Affected >=7.0.0 <7.80, >=8.0.0 <8.9.14, >=9.0.0 <9.0.12, >=9.1.0 <9.1.7Fixed in 7.80 Fixed in 8.9.14 Fixed in 9.0.12 Fixed in 9.1.7OSV source ↗5 years ago

MediumDrupal core Cross-site Scripting (XSS) vulnerability in ckeditorGHSA-c533-c843-67h8BIT-drupal-2020-13669CVE-2020-13669DRUPAL-CORE-2020-010Affected >=8.0.0 <8.8.10, >=8.9.0 <8.9.6, >=9.0.0 <9.0.6Fixed in 8.8.10 Fixed in 8.9.6 Fixed in 9.0.6OSV source ↗5 years ago

MediumCross-site Scripting in Drupal CoreGHSA-m6q5-wv4x-fv6hBIT-drupal-2020-13668CVE-2020-13668Affected >=8.0.0 <8.8.10, >=8.9.0 <8.9.6, >=9.0.0 <9.0.6Fixed in 8.8.10 Fixed in 8.9.6 Fixed in 9.0.6OSV source ↗5 years ago

Mediumckeditor4 vulnerable to cross-site scriptingGHSA-rgx6-rjj4-c388BIT-drupal-2021-33829CVE-2021-33829DRUPAL-CORE-2021-003Affected >=7.0.0 <7.80, >=8.0.0 <8.9.16, >=9.0.0 <9.0.14, >=9.1.0 <9.1.9Fixed in 7.80 Fixed in 8.9.16 Fixed in 9.0.14 Fixed in 9.1.9OSV source ↗5 years ago

MediumDrupal Core Cross-site scripting vulnerabilityGHSA-qf2g-mrrx-rr5pBIT-drupal-2020-13688CVE-2020-13688DRUPAL-CORE-2020-009Affected >=8.0.0 <8.8.10, >=8.9.0 <8.9.6, >=9.0.0 <9.0.6Fixed in 8.8.10 Fixed in 8.9.6 Fixed in 9.0.6OSV source ↗6 years ago

MediumDrupal Core Cross-site scripting vulnerabilityGHSA-8jj2-x2gc-ggm7BIT-drupal-2020-13666CVE-2020-13666DRUPAL-CORE-2020-007Affected >=7.0.0 <7.73, >=8.0.0 <8.8.10, >=8.9.0 <8.9.6, >=9.0.0 <9.0.6Fixed in 7.73 Fixed in 8.8.10 Fixed in 8.9.6 Fixed in 9.0.6OSV source ↗6 years ago

MediumDrupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes VulnerabilityGHSA-2qph-q8xw-gv7qBIT-drupal-2025-31674CVE-2025-31674DRUPAL-CORE-2025-003Affected >=10.4.0 <10.4.3, >=11.0.0 <11.0.12, >=11.1.0 <11.1.3, >=8.0.0 <10.3.13Fixed in 10.3.13 Fixed in 10.4.3 Fixed in 11.0.12 Fixed in 11.1.3OSV source ↗2 years ago

MediumDrupal core Access bypassGHSA-7cwc-fjqm-8vh8BIT-drupal-2024-55634CVE-2024-55634DRUPAL-CORE-2024-004Affected >=10.3.0 <10.3.9, >=11.0.0 <11.0.8, >=8.0.0 <10.2.11Fixed in 10.2.11 Fixed in 10.3.9 Fixed in 11.0.8OSV source ↗2 years ago

MediumDrupal External URL injection through URL aliases leading to Open RedirectGHSA-7f4f-p7mq-p4fvAffected >=7.0 <7.60, >=8.0.0 <8.5.8, >=8.6.0 <8.6.2Fixed in 7.60 Fixed in 8.5.8 Fixed in 8.6.2OSV source ↗2 years ago

MediumDrupal Content moderation Access bypassGHSA-f84q-mgj9-8jfcAffected >=8.0.0 <8.5.8, >=8.6.0 <8.6.2Fixed in 8.5.8 Fixed in 8.6.2OSV source ↗2 years ago

MediumDrupal core Denial of Service vulnerabilityGHSA-6ccv-8fgf-cjpwAffected >=10.2.0 <10.2.2, >=8.0.0 <10.1.8Fixed in 10.1.8 Fixed in 10.2.2OSV source ↗3 years ago

MediumDrupal Denial of Service vulnerabilityGHSA-62cf-jvpp-48q6BIT-drupal-2024-22362CVE-2024-22362Affected ==9.3.6OSV source ↗3 years ago

MediumDrupal core allows Object InjectionGHSA-m6vv-vcj8-w8m7BIT-drupal-2025-13081CVE-2025-13081DRUPAL-CORE-2025-006Affected >=10.5.0 <10.5.6, >=11.0.0 <11.1.9, >=11.2.0 <11.2.8, >=8.0.0 <10.4.9Fixed in 10.4.9 Fixed in 10.5.6 Fixed in 11.1.9 Fixed in 11.2.8OSV source ↗12 months ago

MediumDrupal core vulnerable to improper error handlingGHSA-52jr-x6h6-xj6gBIT-drupal-2024-11942CVE-2024-11942DRUPAL-CORE-2024-002Affected >=10.0.0 <10.2.10Fixed in 10.2.10OSV source ↗2 years ago

MediumDrupal CRLF injection vulnerability in the drupal_set_header functionGHSA-fg5q-r2q5-qmh3CVE-2016-3166Affected >=6.0 <6.38Fixed in 6.38OSV source ↗4 years ago

MediumDrupal file REST resource does not properly validateGHSA-h377-287m-w2r9CVE-2017-6921Affected >=8.0 <8.3.4, 8.0.0-beta6 - 8.0.0-rc4Fixed in 8.3.4OSV source ↗5 years ago

MediumDrupal Anonymous Open Redirect GHSA-gfvf-2f25-f34rAffected >=8.0.0 <8.5.8, >=8.6.0 <8.6.2Fixed in 8.5.8 Fixed in 8.6.2OSV source ↗2 years ago

MediumDrupal Core Cross-Site Scripting (XSS) VulnerabilityGHSA-m4wj-hhwj-47qpBIT-drupal-2025-31675CVE-2025-31675DRUPAL-CORE-2025-004Affected >=10.4.0 <10.4.5, >=11.0.0 <11.0.13, >=11.1.0 <11.1.5, >=8.0.0 <10.3.14Fixed in 10.3.14 Fixed in 10.4.5 Fixed in 11.0.13 Fixed in 11.1.5OSV source ↗2 years ago

MediumDrupal Core Cross-Site Scripting (XSS)GHSA-8mvq-8h2v-j9vfBIT-drupal-2024-12393CVE-2024-12393DRUPAL-CORE-2024-003Affected >=10.3.0 <10.3.9, >=11.0.0 <11.0.8, >=8.8.0 <10.2.11Fixed in 10.2.11 Fixed in 10.3.9 Fixed in 11.0.8OSV source ↗2 years ago

MediumAccess bypass in Drupal coreGHSA-7jr4-hgqx-vwgqBIT-drupal-2022-25274CVE-2022-25274DRUPAL-CORE-2022-009Affected >=9.3.0 <9.3.12Fixed in 9.3.12OSV source ↗5 years ago

MediumSymfony Cross-site Scripting (XSS) vulnerabilityGHSA-g996-q5r8-w7g2CVE-2019-10909Affected >=8.0.0 <8.5.15, >=8.6.0 <8.6.15Fixed in 8.5.15 Fixed in 8.6.15OSV source ↗7 years ago

MediumDrupal Cross Site Scripting (XSS) vulnerabilityGHSA-cmmh-8mwp-gq5pCVE-2019-6341DRUPAL-CORE-2019-004Affected >=7.0.0 <7.65.0, >=8.0.0 <8.5.14, >=8.6.0 <8.6.13Fixed in 7.65.0 Fixed in 8.5.14 Fixed in 8.6.13OSV source ↗8 years ago

MediumDrupal Full Path DisclosureGHSA-mg8j-w93w-xjgcCVE-2024-45440Affected >=10.3.0 <10.3.6, >=11.0.0 <11.0.5, >=8.0.0 <10.2.9Fixed in 10.2.9 Fixed in 10.3.6 Fixed in 11.0.5OSV source ↗2 years ago

MediumDrupal core Cross-Site Scripting (XSS) vulnerabilitiesGHSA-vfgc-c76h-mwh4Affected >=8.0.0 <8.9.18, >=9.1.0 <9.1.12, >=9.2.0 <9.2.4Fixed in 8.9.18 Fixed in 9.1.12 Fixed in 9.2.4OSV source ↗2 years ago

MediumDrupal core Denial of ServiceGHSA-pr99-c33p-fwf6Affected >=8.0.0 <8.7.11, >=8.8.0 <8.8.1Fixed in 8.7.11 Fixed in 8.8.1OSV source ↗2 years ago