.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

drupal/core vulnerabilities

150 known advisories · Dependencies not checked · showing 50 more

SEVERITYADVISORYPUBLISHED

MediumDrupal external link injection vulnerabilityGHSA-wm86-w3cf-h6vmCVE-2017-6932Affected >=7.0 <7.57Fixed in 7.57OSV source ↗4 years ago

MediumDrupal Core Vulnerable to Forceful BrowsingGHSA-wpp8-fjgf-pwc7BIT-drupal-2025-31673CVE-2025-31673DRUPAL-CORE-2025-002Affected >=10.4.0 <10.4.3, >=11.0.0 <11.0.12, >=11.1.0 <11.1.3, >=8.0.0 <10.3.13Fixed in 10.3.13 Fixed in 10.4.3 Fixed in 11.0.12 Fixed in 11.1.3OSV source ↗2 years ago

MediumDrupal core Open Redirect vulnerabilityGHSA-6gf6-24h2-66j4Affected >=7.0.0 <7.70Fixed in 7.70OSV source ↗2 years ago

MediumDrupal core Access bypassGHSA-mh4h-27gq-cxwjAffected >=8.0.0 <8.7.11, >=8.8.0 <8.8.1Fixed in 8.7.11 Fixed in 8.8.1OSV source ↗2 years ago

MediumDrupal Users without "Administer comments" can set comment visibility on nodes they can editGHSA-6g9h-6v79-w4pcCVE-2016-7570Affected >=8.0.0 <8.1.10Fixed in 8.1.10OSV source ↗4 years ago

MediumDrupal Unprivileged access to config exportGHSA-fmqh-2j2x-vgp3CVE-2016-7572Affected >=8.0 <8.1.10, 8.0.0-beta6 - 8.0.0-rc4Fixed in 8.1.10OSV source ↗4 years ago

MediumDrupal sensitive information disclosureGHSA-p745-347h-hjfwCVE-2016-9449Affected >=7.0 <7.52, >=8.0 <8.2.3, 8.0.0-beta6 - 8.0.0-rc4Fixed in 7.52 Fixed in 8.2.3OSV source ↗4 years ago

MediumDrupal core uses a vulnerable Third-party library CKEditorGHSA-v273-j5hq-26xpAffected >=8.0.0 <8.7.12, >=8.8.0 <8.8.4Fixed in 8.7.12 Fixed in 8.8.4OSV source ↗2 years ago

LowDrupal core allows Exploiting Incorrectly Configured Access Control Security LevelsGHSA-mhpg-hpj5-73r2BIT-drupal-2025-13083CVE-2025-13083DRUPAL-CORE-2025-008Affected >=10.5.0 <10.5.6, >=11.0.0 <11.1.9, >=11.2.0 <11.2.8, >=7.0 <7.103, >=8.0.0 <10.4.9Fixed in 10.4.9 Fixed in 10.5.6 Fixed in 11.1.9 Fixed in 11.2.8 Fixed in 7.103OSV source ↗12 months ago

LowDrupal core allows Content SpoofingGHSA-h89p-5896-f4q8BIT-drupal-2025-13082CVE-2025-13082DRUPAL-CORE-2025-007Affected >=10.5.0 <10.5.6, >=11.0.0 <11.1.9, >=11.2.0 <11.2.8, >=8.0.0 <10.4.9Fixed in 10.4.9 Fixed in 10.5.6 Fixed in 11.1.9 Fixed in 11.2.8OSV source ↗12 months ago

LowDrupal core allows Forceful BrowsingGHSA-83v7-c2cf-p9c2BIT-drupal-2025-13080CVE-2025-13080DRUPAL-CORE-2025-005Affected >=10.5.0 <10.5.6, >=11.0.0 <11.1.9, >=11.2.0 <11.2.8, >=8.0.0 <10.4.9Fixed in 10.4.9 Fixed in 10.5.6 Fixed in 11.1.9 Fixed in 11.2.8OSV source ↗12 months ago

UnknownNo summary availableDRUPAL-CORE-2026-016CVE-2026-108514Affected >=10.3.0 <10.6.19, >=11.0.0 <11.3.19, >=11.4.0 <11.4.10, >=12.0.0-alpha1 <12.0.0-beta2Fixed in 10.6.19 Fixed in 11.3.19 Fixed in 11.4.10 Fixed in 12.0.0-beta2OSV source ↗27 days ago

UnknownNo summary availableDRUPAL-CORE-2026-015CVE-2026-108515Affected >=11.0.0 <11.3.19, >=11.4.0 <11.4.10, >=12.0.0-alpha1 <12.0.0-beta2, >=8.9.0 <10.6.19Fixed in 10.6.19 Fixed in 11.3.19 Fixed in 11.4.10 Fixed in 12.0.0-beta2OSV source ↗27 days ago

UnknownNo summary availableDRUPAL-CORE-2026-014CVE-2026-108097Affected >=11.0.0 <11.3.19, >=11.4.0 <11.4.10, >=12.0.0-alpha1 <12.0.0-beta2, >=8.9.0 <10.6.19Fixed in 10.6.19 Fixed in 11.3.19 Fixed in 11.4.10 Fixed in 12.0.0-beta2OSV source ↗27 days ago

UnknownNo summary availableDRUPAL-CORE-2026-013Affected >=10.5.0 <10.6.17, >=11.0.0 <11.3.17, >=11.4.0 <11.4.7Fixed in 10.6.17 Fixed in 11.3.17 Fixed in 11.4.7OSV source ↗2 months ago

UnknownNo summary availableDRUPAL-CORE-2026-012CVE-2026-55805Affected <10.6.13, >=11.0.0 <11.1.0, >=11.1.0 <11.2.0, >=11.2.0 <11.3.0, >=11.3.0 <11.3.14, >=11.4.0 <11.4.4Fixed in 10.6.13 Fixed in 11.1.0 Fixed in 11.2.0 Fixed in 11.3.0 Fixed in 11.3.14 Fixed in 11.4.4OSV source ↗4 months ago

UnknownNo summary availableDRUPAL-CORE-2026-011CVE-2026-15917Affected >=11.2.0 <11.3.0, >=11.3.0 <11.3.14, >=11.4.0 <11.4.4Fixed in 11.3.0 Fixed in 11.3.14 Fixed in 11.4.4OSV source ↗4 months ago

UnknownNo summary availableDRUPAL-CORE-2026-010CVE-2026-15916Affected <10.6.13, >=11.0.0 <11.1.0, >=11.1.0 <11.2.0, >=11.2.0 <11.3.0, >=11.3.0 <11.3.14, >=11.4.0 <11.4.4Fixed in 10.6.13 Fixed in 11.1.0 Fixed in 11.2.0 Fixed in 11.3.0 Fixed in 11.3.14 Fixed in 11.4.4OSV source ↗4 months ago

UnknownNo summary availableDRUPAL-CORE-2026-009BIT-drupal-2026-55808CVE-2026-55808Affected <10.5.12, >=10.6.0 <10.6.11, >=11.0.0 <11.1.0, >=11.1.0 <11.2.0, >=11.2.0 <11.2.14, >=11.3.0 <11.3.12Fixed in 10.5.12 Fixed in 10.6.11 Fixed in 11.1.0 Fixed in 11.2.0 Fixed in 11.2.14 Fixed in 11.3.12OSV source ↗5 months ago

UnknownNo summary availableDRUPAL-CORE-2026-008BIT-drupal-2026-55807CVE-2026-55807Affected <10.5.12, >=10.6.0 <10.6.11, >=11.0.0 <11.1.0, >=11.1.0 <11.2.0, >=11.2.0 <11.2.14, >=11.3.0 <11.3.12Fixed in 10.5.12 Fixed in 10.6.11 Fixed in 11.1.0 Fixed in 11.2.0 Fixed in 11.2.14 Fixed in 11.3.12OSV source ↗5 months ago

UnknownNo summary availableDRUPAL-CORE-2026-007BIT-drupal-2026-55806CVE-2026-55806Affected <10.5.12, >=10.6.0 <10.6.11, >=11.0.0 <11.1.0, >=11.1.0 <11.2.0, >=11.2.0 <11.2.14, >=11.3.0 <11.3.12Fixed in 10.5.12 Fixed in 10.6.11 Fixed in 11.1.0 Fixed in 11.2.0 Fixed in 11.2.14 Fixed in 11.3.12OSV source ↗5 months ago

UnknownNo summary availableDRUPAL-CORE-2026-006BIT-drupal-2026-55804CVE-2026-55804Affected <10.5.12, >=10.6.0 <10.6.11, >=11.0.0 <11.1.0, >=11.1.0 <11.2.0, >=11.2.0 <11.2.14, >=11.3.0 <11.3.12Fixed in 10.5.12 Fixed in 10.6.11 Fixed in 11.1.0 Fixed in 11.2.0 Fixed in 11.2.14 Fixed in 11.3.12OSV source ↗5 months ago

UnknownNo summary availableDRUPAL-CORE-2026-005BIT-drupal-2026-55803CVE-2026-55803Affected <10.5.12, >=10.6.0 <10.6.11, >=11.0.0 <11.1.0, >=11.1.0 <11.2.0, >=11.2.0 <11.2.14, >=11.3.0 <11.3.12Fixed in 10.5.12 Fixed in 10.6.11 Fixed in 11.1.0 Fixed in 11.2.0 Fixed in 11.2.14 Fixed in 11.3.12OSV source ↗5 months ago

UnknownNo summary availableDRUPAL-CORE-2023-004Affected >=10.0.0 <10.0.5, >=8.0.0 <9.4.12, >=9.5.0 <9.5.5Fixed in 10.0.5 Fixed in 9.4.12 Fixed in 9.5.5OSV source ↗4 years ago

UnknownNo summary availableDRUPAL-CORE-2023-003Affected >=10.0.0 <10.0.5, >=8.0.0 <9.4.12, >=9.5.0 <9.5.5Fixed in 10.0.5 Fixed in 9.4.12 Fixed in 9.5.5OSV source ↗4 years ago

UnknownNo summary availableDRUPAL-CORE-2023-002Affected >=10.0.0 <10.0.5, >=8.0.0 <9.4.12, >=9.5.0 <9.5.5Fixed in 10.0.5 Fixed in 9.4.12 Fixed in 9.5.5OSV source ↗4 years ago

UnknownNo summary availableDRUPAL-CORE-2023-001Affected >=10.0.0 <10.0.2, >=8.0.0 <9.4.10, >=9.5.0 <9.5.2Fixed in 10.0.2 Fixed in 9.4.10 Fixed in 9.5.2OSV source ↗4 years ago

UnknownNo summary availableDRUPAL-CORE-2022-016BIT-drupal-2022-39261CVE-2022-39261GHSA-52m2-vc4m-jj33Affected >=8.0.0 <9.3.22, >=9.4.0 <9.4.7Fixed in 9.3.22 Fixed in 9.4.7OSV source ↗4 years ago

UnknownNo summary availableDRUPAL-CORE-2022-011BIT-drupal-2022-31042BIT-drupal-2022-31043CVE-2022-31042CVE-2022-31043GHSA-f2wf-25xc-69c9GHSA-w248-ffj2-4v5qAffected >=8.0.0 <9.2.21, >=9.3.0 <9.3.16Fixed in 9.2.21 Fixed in 9.3.16OSV source ↗4 years ago

UnknownNo summary availableDRUPAL-CORE-2022-010BIT-drupal-2022-29248CVE-2022-29248GHSA-cwmx-hcrq-mhc3Affected >=8.0.0 <9.2.20, >=9.3.0 <9.3.14Fixed in 9.2.20 Fixed in 9.3.14OSV source ↗4 years ago

UnknownNo summary availableDRUPAL-CORE-2022-006BIT-drupal-2022-24775CVE-2022-24775GHSA-q7rv-6hp3-vh96Affected >=8.0.0 <9.2.16, >=9.3.0 <9.3.9Fixed in 9.2.16 Fixed in 9.3.9OSV source ↗5 years ago

UnknownNo summary availableDRUPAL-CORE-2022-005BIT-drupal-2022-24728BIT-drupal-2022-24729CVE-2022-24728CVE-2022-24729GHSA-4fc4-4p5g-6w89GHSA-f6rf-9m92-x2hhAffected >=8.0.0 <9.2.15, >=9.3.0 <9.3.8Fixed in 9.2.15 Fixed in 9.3.8OSV source ↗5 years ago

UnknownNo summary availableDRUPAL-CORE-2022-001Affected >=8.0.0 <9.2.11, >=9.3.0 <9.3.3Fixed in 9.2.11 Fixed in 9.3.3OSV source ↗5 years ago

UnknownNo summary availableDRUPAL-CORE-2021-011Affected >=8.0.0 <8.9.20, >=9.1.0 <9.1.14, >=9.2.0 <9.2.9Fixed in 8.9.20 Fixed in 9.1.14 Fixed in 9.2.9OSV source ↗5 years ago

UnknownNo summary availableDRUPAL-CORE-2021-006CVE-2020-13673DRUPAL-CONTRIB-2021-028Affected >=8.0.0 <8.9.19, >=9.1.0 <9.1.13, >=9.2.0 <9.2.6Fixed in 8.9.19 Fixed in 9.1.13 Fixed in 9.2.6OSV source ↗5 years ago

UnknownNo summary availableDRUPAL-CORE-2021-005Affected >=8.0.0 <8.9.18, >=9.1.0 <9.1.12, >=9.2.0 <9.2.4Fixed in 8.9.18 Fixed in 9.1.12 Fixed in 9.2.4OSV source ↗5 years ago

UnknownNo summary availableDRUPAL-CORE-2021-004CVE-2021-32610GHSA-p8q8-jfcv-g2h2Affected >=8.0.0 <8.9.17, >=9.1.0 <9.1.11, >=9.2.0 <9.2.2Fixed in 8.9.17 Fixed in 9.1.11 Fixed in 9.2.2OSV source ↗5 years ago

UnknownNo summary availableDRUPAL-CORE-2021-001Affected >=8.0.0 <8.9.13, >=9.0.0 <9.0.11, >=9.1.0 <9.1.3Fixed in 8.9.13 Fixed in 9.0.11 Fixed in 9.1.3OSV source ↗6 years ago

UnknownNo summary availableDRUPAL-CORE-2020-013BIT-drupal-2020-28948BIT-drupal-2020-28949CVE-2020-28948CVE-2020-28949GHSA-75c5-f4gw-38r9GHSA-jh5x-hfhg-78jqAffected >=8.0.0 <8.8.12, >=8.9.0 <8.9.10, >=9.0.0 <9.0.9Fixed in 8.8.12 Fixed in 8.9.10 Fixed in 9.0.9OSV source ↗6 years ago

UnknownNo summary availableDRUPAL-CORE-2020-006CVE-2020-13665 Affected >=8.0.0 <8.8.8, >=8.9.0 <8.9.1, >=9.0.0 <9.0.1Fixed in 8.8.8 Fixed in 8.9.1 Fixed in 9.0.1OSV source ↗6 years ago

UnknownNo summary availableDRUPAL-CORE-2020-002Affected >=8.0.0 <8.7.14, >=8.8.0 <8.8.6Fixed in 8.7.14 Fixed in 8.8.6OSV source ↗6 years ago

UnknownNo summary availableDRUPAL-CORE-2020-001Affected >=8.0.0 <8.7.12, >=8.8.0 <8.8.4Fixed in 8.7.12 Fixed in 8.8.4OSV source ↗7 years ago

UnknownNo summary availableDRUPAL-CORE-2019-012Affected >=8.0.0 <8.7.11, >=8.8.0 <8.8.1Fixed in 8.7.11 Fixed in 8.8.1OSV source ↗7 years ago

UnknownNo summary availableDRUPAL-CORE-2019-011Affected >=8.0.0 <8.7.11, >=8.8.0 <8.8.1Fixed in 8.7.11 Fixed in 8.8.1OSV source ↗7 years ago

UnknownNo summary availableDRUPAL-CORE-2019-010Affected >=8.0.0 <8.7.11, >=8.8.0 <8.8.1Fixed in 8.7.11 Fixed in 8.8.1OSV source ↗7 years ago

UnknownNo summary availableDRUPAL-CORE-2019-009Affected >=8.0.0 <8.7.11, >=8.8.0 <8.8.1Fixed in 8.7.11 Fixed in 8.8.1OSV source ↗7 years ago

UnknownNo summary availableDRUPAL-CORE-2019-006CVE-2019-11358GHSA-6c3j-c64m-qhgqPYSEC-2026-628SNYK-JS-JQUERY-174006Affected >=8.0.0 <8.5.15, >=8.6.0 <8.6.15Fixed in 8.5.15 Fixed in 8.6.15OSV source ↗8 years ago

UnknownNo summary availableDRUPAL-CORE-2019-005Affected >=8.0.0 <8.5.15, >=8.6.0 <8.6.15Fixed in 8.5.15 Fixed in 8.6.15OSV source ↗8 years ago

UnknownNo summary availableDRUPAL-CORE-2019-001CVE-2019-6338GHSA-6rmq-x2hv-vxppAffected >=8.0.0 <8.5.9, >=8.6.0 <8.6.6Fixed in 8.5.9 Fixed in 8.6.6OSV source ↗8 years ago

UnknownNo summary availableDRUPAL-CORE-2018-001Affected >=8.0.0 <8.4.5Fixed in 8.4.5OSV source ↗9 years ago