Composer drupal/core has 164 known advisories in the phpwarden feed, 5 actively exploited. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2018-7600 KEV | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows a | critical | 9.8 | >= 8.0.0 <8.3.9 or >=8.4.0 <8.4.6 or >=8.5.0 <8.5.1 or >=7.0 and <7.58 or >=8.0 and <8.3.9 or >=8.4.0 and <8.4.6 or >=8.5.0 and <8.5.1 or >=8.4 and <8.4.6 or >=8.5 and <8.5.1 | 8.3.9, 8.4.6, 8.5.1, 7.58 |
| CVE-2018-7602 KEV | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows a | critical | 9.8 | >= 8.0.0 <8.4.8 or >=8.5.0 <8.5.3 or >=7.0 and <7.59 or >=8.0 and <8.4.8 or >=8.5 and <8.5.3 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4 and <8.4.8 | 8.4.8, 8.5.3, 7.59 |
| CVE-2019-6340 KEV | Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in s | high | 8.1 | >= 8.0.0 <8.5.11 or >=8.6.0 <8.6.10 or >=8.6.0 and <8.6.10 or >=7.0.0 and <7.62.0 or >=8.0.0 and <8.5.11 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.5.11 | 8.5.11, 8.6.10, 7.62.0 |
| CVE-2026-9082 KEV | Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to pr | critical | 9.8 | >= 8.9.0 < 10.4.10 or >= 10.5.0 < 10.5.10 or >= 10.6.0 < 10.6.9 or >= 11.0.0 < 11.1.10 or >= 11.2.0 < 11.2.12 or >= 11.3.0 < 11.3.10 or >=8.9.0 and <10.4.10 or >=10.5.0 and <10.5.10 or >=10.6.0 and <10.6.9 or >=11.0.0 and <11.1.10 or >=11.2.0 and <11.2.12 or >=11.3.0 and <11.3.10 | 10.4.10, 10.5.10, 10.6.9, 11.1.10 |
| CVE-2020-13671 KEV | *Update November 18: Documented longer list of dangerous file extensions* Drupal core does not properly sanitize certai | high | 8.8 | >= 8.0.0 <8.8.11 or >= 8.9.0 <8.9.9 or >=9.0.0 <9.0.8 or >=9.0.0 and <9.0.8 or >=8.9.0 and <8.9.9 or >=8.0.0 and <8.8.11 or >=7.0.0 and <7.74 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.8.0 or >=8.8.0 and <8.8.11 | 8.8.11, 8.9.9, 9.0.8, 7.74 |
| CVE-2019-11358 | The jQuery project released version 3.4.0, and as part of that, disclosed a security vulnerability that affects all prio | unknown | 0.0 | >= 8.0.0 <8.5.15 or >=8.6.0 <8.6.15 | 8.5.15, 8.6.15 |
| CVE-2021-32610 | The Drupal project uses the pear Archive\_Tar library, which has released a security update that impacts Drupal. The vu | unknown | 0.0 | >= 8.0.0 <8.9.17 or >= 9.1.0 <9.1.11 or >=9.2.0 <9.2.2 | 8.9.17, 9.1.11, 9.2.2 |
| CVE-2016-5385 | HTTP Proxy header vulnerability | high | 8.1 | >=8.0 and <8.1.7 or >=8.0 and <8.1.0 or >=8.1.0 and <8.1.7 | 8.1.7 |
| CVE-2020-28948 | The Drupal project uses the PEAR Archive\_Tar library. The PEAR Archive\_Tar library has released a security update that | unknown | 0.0 | >= 8.0.0 <8.8.12 or >= 8.9.0 <8.9.10 or >=9.0.0 <9.0.9 | 8.8.12, 8.9.10, 9.0.9 |
| CVE-2019-6339 | A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an | critical | 9.8 | >= 8.0.0 <8.5.9 or >=8.6.0 <8.6.6 or >=7.0.0 and <7.62.0 or >=8.0.0 and <8.5.9 or >=8.6.0 and <8.6.6 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.5.9 | 8.5.9, 8.6.6, 7.62.0 |
| CVE-2017-6920 | Drupal PECL YAML parser unsafe object handling | critical | 9.8 | >=8.0 and <8.3.4 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.3.4 | 8.3.4 |
| CVE-2019-6341 | Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross- | medium | 5.4 | >= 8.0.0 <8.5.14 or >=8.6.0 <8.6.13 or >=7.0.0 and <7.65.0 or >=8.0.0 and <8.5.14 or >=8.6.0 and <8.6.13 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.5.14 | 8.5.14, 8.6.13, 7.65.0 |
| CVE-2024-45440 | Drupal Full Path Disclosure | medium | 5.3 | >=10.3.0 and <10.3.6 or >=11.0.0 and <11.0.5 or >=8.0.0 and <10.2.9 | 10.3.6, 11.0.5, 10.2.9 |
| CVE-2019-11831 | This security release fixes third-party dependencies included in or required by Drupal core. As described in [TYPO3-PSA- | critical | 9.8 | >= 8.0.0 <8.6.16 or >=8.7.0 <8.7.1 or >=7.0.0 and <7.67.0 or >=8.0.0 and <8.6.16 or >=8.7.0 and <8.7.1 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.6.16 | 8.6.16, 8.7.1, 7.67.0 |
| CVE-2017-6381 | Drupal Remote code execution | high | 8.1 | >=8.0 and <8.2.7 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.2.7 | 8.2.7 |
| CVE-2016-3171 | Drupal arbitrary code execution | high | 8.1 | >=6.0 and <6.38 or >=8.0 and <8.0.4 | 6.38, 8.0.4 |
| CVE-2021-33829 | **Update: 2021-06-11: Added CVE-2021-33829 identifier** Drupal core uses the third-party CKEditor library. This library | medium | 6.1 | >= 8.0.0 <8.9.16 or >= 9.0.0 <9.0.14 or >=9.1.0 <9.1.9 or >=7.0.0 and <7.80 or >=8.0.0 and <8.9.16 or >=9.0.0 and <9.0.14 or >=9.1.0 and <9.1.9 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.8.0 or >=8.8.0 and <8.9.0 or >=8.9.0 and <8.9.16 | 8.9.16, 9.0.14, 9.1.9, 7.80 |
| CVE-2022-39261 | Drupal uses the [Twig](https://twig.symfony.com/) third-party library for content templating and sanitization. [Twig has | unknown | 0.0 | >= 8.0.0 <9.3.22 or >= 9.4.0 <9.4.7 | 9.3.22, 9.4.7 |
| CVE-2011-2687 | Drupal Access Control Bypass | high | 0.0 | >=7.0 and <7.3 | 7.3 |
| CVE-2017-6925 | Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions | critical | 9.8 | >=8.0 and <8.3.7 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.3.7 | 8.3.7 |
| CVE-2020-13664 | Drupal 8 and 9 have a remote code execution vulnerability under certain circumstances. An attacker could trick an admin | high | 8.8 | >= 8.0.0 <8.8.8 or >= 8.9.0 <8.9.1 or >=9.0.0 <9.0.1 or >=8.8.0 and <8.8.8 or >=8.9.0 and <8.9.1 or >=9.0.0 and <9.0.1 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.8.0 | 8.8.8, 8.9.1, 9.0.1 |
| CVE-2020-13666 | The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting. | medium | 6.1 | >= 8.0.0 <8.8.10 or >= 8.9.0 <8.9.6 or >=9.0.0 <9.0.6 or >=8.8.0 and <8.8.10 or >=8.9.0 and <8.9.6 or >=9.0.0 and <9.0.6 or >=7.0.0 and <7.73 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.8.0 | 8.8.10, 8.9.6, 9.0.6, 7.73 |
| CVE-2016-6211 | Drupal Saving user accounts can sometimes grant the user all roles | high | 8.8 | >=7.0 and <7.44 or >=8.0 and <8.1.0 or >=8.1.0 and <8.1.3 | 7.44, 8.1.3 |
| CVE-2022-24775 | Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. [Guzzle has re | unknown | 0.0 | >= 8.0.0 <9.2.16 or >= 9.3.0 <9.3.9 | 9.2.16, 9.3.9 |
| CVE-2016-3168 | Drupal Reflected file download vulnerability | medium | 6.4 | >=6.0 and <6.38 or >=7.0 and <7.43 or >=8.0 and <8.0.4 | 6.38, 7.43, 8.0.4 |
| CVE-2016-3169 | Drupal saving user accounts can sometimes grant the user all roles | high | 8.1 | >=6.0 and <6.38 or >=7.0 and <7.43 or >=8.0 and <8.0.4 | 6.38, 7.43, 8.0.4 |
| CVE-2016-6212 | Drupal Views can allow unauthorized users to see Statistics information | medium | 5.3 | >=8.0 and <8.1.3 or >=8.0 and <8.1.0 or >=8.1.0 and <8.1.3 | 8.1.3 |
| CVE-2019-6342 | In Drupal 8.7.4, when the [experimental](https://www.drupal.org/core/experimental#beta) Workspaces module is enabled, an | critical | 9.8 | >=8.7.4 <8.7.5 or >=8.7.4 and <8.7.5 or >8.7.3 and <8.7.5 | 8.7.5 |
| CVE-2019-6338 | Drupal core uses the third-party PEAR Archive\_Tar library. This library has released a security update which impacts so | unknown | 0.0 | >= 8.0.0 <8.5.9 or >=8.6.0 <8.6.6 or >=7.0.0 and <7.62.0 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.5.9 or >=8.6.0 and <8.6.6 | 8.5.9, 8.6.6, 7.62.0 |
| CVE-2017-6924 | Drupal REST API can bypass comment approval | high | 7.4 | >=8.0 and <8.3.7 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.3.7 | 8.3.7 |
| CVE-2016-3170 | Drupal sensitive information disclosure | medium | 5.3 | >=7.0 and <7.43 or >=8.0 and <8.0.4 | 7.43, 8.0.4 |
| CVE-2017-6923 | Missing Authorization in Drupal | medium | 6.5 | >=8.0 and <8.3.7 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.3.7 | 8.3.7 |
| CVE-2022-31042 | *Updated 22:00 UTC 2022-06-10: Added steps to update without `drupal/core-recommended`.* Drupal uses the third-party Gu | unknown | 0.0 | >= 8.0.0 <9.2.21 or >= 9.3.0 <9.3.16 | 9.2.21, 9.3.16 |
| CVE-2017-6922 | Drupal core access bypass vulnerability | medium | 6.5 | >=7.0 and <7.56 or >=8.0 and <8.3.4 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.3.4 | 7.56, 8.3.4 |
| CVE-2016-3164 | Drupal Open Redirect | high | 7.4 | >=8.0 and <8.0.4 or >=7.0 and <7.43 or >=6.0 and <6.38 | 8.0.4, 7.43, 6.38 |
| CVE-2016-9449 | Drupal sensitive information disclosure | medium | 4.3 | >=7.0 and <7.52 or >=8.0 and <8.2.3 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.2.3 | 7.52, 8.2.3 |
| CVE-2017-6377 | Drupal editor module incorrectly checks access to inline private files | high | 7.5 | >=8.2.0 and <8.2.7 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 | 8.2.7 |
| CVE-2017-6921 | Drupal file REST resource does not properly validate | medium | 5.9 | >=8.0 and <8.3.4 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.3.4 | 8.3.4 |
| CVE-2016-9452 | Drupal Denial of service via transliterate mechanism | medium | 6.5 | >=8.0 and <8.2.3 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.2.3 | 8.2.3 |
| CVE-2018-9861 | CKEditor, a third-party JavaScript library included in Drupal core, has [fixed a cross-site scripting (XSS) vulnerabilit | medium | 6.1 | >= 8.0.0 <8.4.7 or >=8.5.0 <8.5.2 or >=8.5.0 and <8.5.2 or >=8.0 and <8.4.7 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4 and <8.4.7 or >=8.5 and <8.5.2 | 8.4.7, 8.5.2 |
| CVE-2016-7572 | Drupal Unprivileged access to config export | medium | 4.3 | >=8.0 and <8.1.10 or >=8.0 and <8.1.0 or >=8.1.0 and <8.1.10 | 8.1.10 |
| CVE-2016-7570 | Drupal Users without "Administer comments" can set comment visibility on nodes they can edit | medium | 4.3 | >=8.0.0 and <8.1.10 or >=8.0 and <8.1.0 or >=8.1.0 and <8.1.10 | 8.1.10 |
| CVE-2017-6919 | Drupal access control bypass vulnerability | high | 7.5 | >=8.0 and <8.2.8 or >=8.3.0 and <8.3.1 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.2.8 | 8.2.8, 8.3.1 |
| CVE-2017-6927 | Drupal cross-site scripting vulnerability | medium | 6.1 | >=8.4.0 and <8.4.5 or >=7.0 and <7.57 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 | 8.4.5, 7.57 |
| CVE-2016-3162 | Drupal File upload access bypass and denial of service | high | 8.1 | >=7.0 and <7.43 or >=8.0 and <8.0.4 | 7.43, 8.0.4 |
| CVE-2016-9451 | Drupal Open Redirect | medium | 6.8 | >=7.0 and <7.52 or >=8.0 and <8.2.3 | 7.52, 8.2.3 |
| CVE-2016-7571 | Drupal Cross-site scripting (XSS) vulnerability | medium | 6.1 | >=8.0 and <8.1.10 or >=8.0 and <8.1.0 or >=8.1.0 and <8.1.10 | 8.1.10 |
| CVE-2016-3163 | Drupal Brute force amplification attacks via XML-RPC | high | 7.5 | >=7.0 and <7.43 or >=6.0 and <6.38 or >=8.0 and <8.0.4 | 7.43, 6.38, 8.0.4 |
| CVE-2022-25277 | *Updated 2022-07-20 19:45 UTC to indicate that this only affects Apache web servers.* Drupal core sanitizes filenames w | high | 7.2 | >= 8.0.0 <9.3.19 or >= 9.4.0 <9.4.3 or >=8.0.0 and <9.3.19 or >=9.4.0 and <9.4.3 or >=8.9.0 and <8.10.0 or >=9.0.0 and <9.1.0 or >=9.1.0 and <9.2.0 or >=9.2.0 and <9.3.0 or >=9.3.0 and <9.3.19 | 9.3.19, 9.4.3 |
| CVE-2020-13675 | Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all | critical | 9.8 | >= 8.0.0 <8.9.19 or >= 9.1.0 <9.1.13 or >=9.2.0 <9.2.6 or >=8.0.0 and <8.9.19 or >=9.1.0 and <9.1.13 or >=9.2.0 and <9.2.6 | 8.9.19, 9.1.13, 9.2.6 |
| CVE-2022-29248 | Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. [Guzzle has re | unknown | 0.0 | >= 8.0.0 <9.2.20 or >= 9.3.0 <9.3.14 | 9.2.20, 9.3.14 |
| CVE-2016-3165 | Drupal Form API ignores access restrictions on submit buttons | high | 7.5 | >=6.0 and <6.38 or >=8.0 and <8.0.4 | 6.38, 8.0.4 |
| CVE-2016-3167 | Drupal Open redirect vulnerability in the drupal_goto function | high | 7.4 | >=6.0 and <6.38 or >=8.0 and <8.0.4 | 6.38, 8.0.4 |
| CVE-2017-6930 | Drupal access bypass vulnerability | high | 8.1 | >=8.4.0 and <8.4.5 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 | 8.4.5 |
| CVE-2020-13665 | Drupal Core Access bypass vulnerability | critical | 9.8 | >=8.8.0 and <8.8.8 or >=8.9.0 and <8.9.1 or >=9.0.0 and <9.0.1 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.8.0 | 8.8.8, 8.9.1, 9.0.1 |
| CVE-2022-25271 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to impro | high | 7.5 | >= 8.0.0 <9.2.13 or >= 9.3.0 <9.3.6 or >=9.3.0 and <9.3.6 or >=8.0.0 and <9.2.13 or >=7.0.0 and <7.88 | 9.2.13, 9.3.6, 7.88 |
| CVE-2017-6929 | Drupal cross site scripting vulnerability | medium | 6.1 | >=7.0 and <7.57 or >=8.0 and <8.4.0 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.4.5 | 7.57, 8.4.5 |
| CVE-2020-13677 | Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which ma | high | 7.5 | >= 8.0.0 <8.9.19 or >= 9.1.0 <9.1.13 or >=9.2.0 <9.2.6 or >=8.0.0 and <8.9.19 or >=9.1.0 and <9.1.13 or >=9.2.0 and <9.2.6 | 8.9.19, 9.1.13, 9.2.6 |
| CVE-2017-6926 | Drupal Comment reply form allows access to restricted content | high | 8.1 | >=8.4.0 and <8.4.5 or >=7.0 and <7.57 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 | 8.4.5, 7.57 |
| CVE-2022-24728 | The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4) library for WYSIWYG editing. CKEditor has | unknown | 0.0 | >= 8.0.0 <9.2.15 or >= 9.3.0 <9.3.8 | 9.2.15, 9.3.8 |
| CVE-2011-2714 | Drupal Cross-Site Scripting vulnerability | medium | 6.1 | =6.20 | – |
| CVE-2016-3166 | Drupal CRLF injection vulnerability in the drupal_set_header function | medium | 5.9 | >=6.0 and <6.38 or >=8.0 and <8.0.4 | 6.38, 8.0.4 |
| CVE-2017-6932 | Drupal external link injection vulnerability | medium | 4.7 | >=7.0 and <7.57 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.4.5 | 7.57, 8.4.5 |
| CVE-2020-13670 | A vulnerability exists in the File module which allows an attacker to gain access to the file metadata of a permanent pr | high | 7.5 | >= 8.0.0 <8.8.10 or >= 8.9.0 <8.9.6 or >=9.0.0 <9.0.6 or >=8.0.0 and <8.8.10 or >=8.9.0 and <8.9.6 or >=9.0.0 and <9.0.6 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.8.0 or >=8.8.0 and <8.8.10 | 8.8.10, 8.9.6, 9.0.6 |
| CVE-2017-6931 | Drupal Settings Tray access bypass | medium | 6.5 | >=8.4.0 and <8.4.5 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 | 8.4.5 |
| CVE-2011-2715 | Drupal SQL Injection vulnerability | critical | 9.8 | =6.20 | – |
| CVE-2019-10909 | Symfony Cross-site Scripting (XSS) vulnerability | medium | 5.4 | >=8.0.0 and <8.5.15 or >=8.6.0 and <8.6.15 or >=7.0 and <7.65 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.5.14 or >=8.6.0 and <8.6.14 | 8.5.15, 8.6.15, 7.65 |
| CVE-2017-6928 | Drupal access bypass vulnerability | medium | 5.3 | >=7.0 and <7.57 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.4.5 | 7.57, 8.4.5 |
| CVE-2016-9450 | Drupal Incorrect cache context on password reset page | high | 7.5 | >=8.0 and <8.2.3 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.2.3 | 8.2.3 |
| CVE-2024-55638 | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | >= 8.0.0 < 10.2.11 or >= 10.3.0 < 10.3.9 or >=8.8.0 and <10.2.11 or >=10.3.0 and <10.3.9 or >=7.0 and <7.102 | 10.2.11, 10.3.9, 7.102 |
| CVE-2024-55636 | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | >= 8.0.0 < 10.2.11 or >= 10.3.0 < 10.3.9 or >= 11.0.0 < 11.0.8 or >=8.8.0 and <10.2.11 or >=10.3.0 and <10.3.9 or >=11.0.0 and <11.0.8 | 10.2.11, 10.3.9, 11.0.8 |
| CVE-2020-13667 | The experimental Workspaces module allows you to create multiple workspaces on your site in which draft content can be e | medium | 5.3 | >= 8.0.0 <8.8.10 or >= 8.9.0 <8.9.6 or >=9.0.0 <9.0.6 or >=8.8.0 and <8.8.10 or >=8.9.0 and <8.9.6 or >=9.0.0 and <9.0.6 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.8.0 | 8.8.10, 8.9.6, 9.0.6 |
| CVE-2020-13662 | Drupal Core Open Redirect vulnerability | medium | 6.1 | >=7.0.0 and <7.70 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.7.14 or >=8.8.0 and <8.8.6 | 7.70, 8.7.14, 8.8.6 |
| CVE-2023-5256 | In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause se | critical | 0.0 | >=8.7.0 <9.5.11 or >=10.0 <10.0.11 or >= 10.1 <10.1.4 or >=8.7.0 and <9.5.11 or >=10.0.0 and <10.0.11 or >=10.1.0 and <10.1.4 | 9.5.11, 10.0.11, 10.1.4 |
| CVE-2024-55637 | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | >= 8.0.0 < 10.2.11 or >= 10.3.0 < 10.3.9 or >= 11.0.0 < 11.0.8 or >=8.8.0 and <10.2.11 or >=10.3.0 and <10.3.9 or >=11.0.0 and <11.0.8 | 10.2.11, 10.3.9, 11.0.8 |
| CVE-2020-13676 | The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclo | medium | 6.5 | >= 8.0.0 <8.9.19 or >= 9.1.0 <9.1.13 or >=9.2.0 <9.2.6 or >=8.0.0 and <8.9.19 or >=9.1.0 and <9.1.13 or >=9.2.0 and <9.2.6 | 8.9.19, 9.1.13, 9.2.6 |
| CVE-2024-22362 | Drupal Denial of Service vulnerability | medium | 0.0 | =9.3.6 | – |
| CVE-2020-13668 | Cross-site Scripting in Drupal Core | medium | 6.1 | >=8.0.0 and <8.8.10 or >=8.9.0 and <8.9.6 or >=9.0.0 and <9.0.6 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.8.0 or >=8.8.0 and <8.8.10 | 8.8.10, 8.9.6, 9.0.6 |
| CVE-2017-6379 | Drupal Cross-Site Request Forgery (CSRF) | high | 7.5 | >=8.2.0 and <8.2.7 or >=8.0 and <8.1.0 or >=8.1.0 and <8.2.0 | 8.2.7 |
| CVE-2022-25270 | The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the " | medium | 6.5 | >= 8.0.0 <9.2.13 or >= 9.3.0 <9.3.6 or >=9.3.0 and <9.3.6 or >=8.0.0 and <9.2.13 | 9.2.13, 9.3.6 |
| CVE-2020-13669 | Drupal core's built-in CKEditor image caption functionality is vulnerable to XSS. | medium | 6.1 | >= 8.0.0 <8.8.10 or >= 8.9.0 <8.9.6 or >=9.0.0 <9.0.6 or >=8.0.0 and <8.8.10 or >=8.9.0 and <8.9.6 or >=9.0.0 and <9.0.6 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.8.0 or >=8.8.0 and <8.8.10 | 8.8.10, 8.9.6, 9.0.6 |
| CVE-2020-13663 | The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other v | high | 8.8 | >= 8.0.0 <8.8.8 or >= 8.9.0 <8.9.1 or >=9.0.0 <9.0.1 or >=8.9.0 and <8.9.1 or >=9.0.0 and <9.0.1 or >=7.0.0 and <7.72 or >=8.0.0 and <8.8.8 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.8.0 or >=8.8.0 and <8.8.8 | 8.8.8, 8.9.1, 9.0.1, 7.72 |
| CVE-2020-13672 | Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. Not all sites | medium | 6.1 | >= 8.0.0 <8.9.14 or >= 9.0.0 <9.0.12 or >=9.1.0 <9.1.7 or >=7.0.0 and <7.80 or >=8.0.0 and <8.9.14 or >=9.0.0 and <9.0.12 or >=9.1.0 and <9.1.7 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.8.0 or >=8.8.0 and <8.9.0 or >=8.9.0 and <8.9.14 | 8.9.14, 9.0.12, 9.1.7, 7.80 |
| CVE-2022-25275 | In some situations, the Image module does not correctly check access to image files not stored in the standard public fi | high | 7.5 | >= 8.0.0 <9.3.19 or >= 9.4.0 <9.4.3 or >=7.0.0 and <7.91 or >=8.0.0 and <9.3.19 or >=9.4.0 and <9.4.3 or >=7.0.0 and <7.91.0 or >=8.9.0 and <8.10.0 or >=9.0.0 and <9.1.0 or >=9.1.0 and <9.2.0 or >=9.2.0 and <9.3.0 or >=9.3.0 and <9.3.19 | 9.3.19, 9.4.3, 7.91, 7.91.0 |
| CVE-2020-13688 | Drupal 8 and 9 have a reflected cross-site scripting (XSS) vulnerability under certain circumstances. An attacker could | medium | 6.1 | >= 8.0.0 <8.8.10 or >= 8.9.0 <8.9.6 or >=9.0.0 <9.0.6 or >=8.8.0 and <8.8.10 or >=8.9.0 and <8.9.6 or >=9.0.0 and <9.0.6 | 8.8.10, 8.9.6, 9.0.6 |
| CVE-2025-31674 | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | medium | 0.0 | >= 8.0.0 < 10.3.13 or >= 10.4.0 < 10.4.3 or >= 11.0.0 < 11.0.12 or >= 11.1.0 < 11.1.3 or >=8.0.0 and <10.3.13 or >=10.4.0 and <10.4.3 or >=11.0.0 and <11.0.12 or >=11.1.0 and <11.1.3 | 10.3.13, 10.4.3, 11.0.12, 11.1.3 |
| CVE-2022-25278 | Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user | medium | 6.5 | >= 8.0.0 <9.3.19 or >= 9.4.0 <9.4.3 or >=8.0.0 and <9.3.19 or >=9.4.0 and <9.4.3 | 9.3.19, 9.4.3 |
| CVE-2022-25273 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to impro | high | 7.5 | >= 8.0.0 <9.2.18 or >= 9.3.0 <9.3.12 or >=8.0.0 and <9.2.18 or >=9.3.0 and <9.3.12 | 9.2.18, 9.3.12 |
| CVE-2023-31250 | The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gain | critical | 0.0 | >=8.0.0 <9.4.14 or >=9.5.0 <9.5.8 or >=10.0.0 <10.0.8 or >=10.0.0 and <10.0.8 or >=9.5.0 and <9.5.8 or >=9.0.0 and <9.4.14 or >=7.0.0 and <7.96 | 9.4.14, 9.5.8, 10.0.8, 7.96 |
| CVE-2022-25276 | The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed | medium | 6.1 | >= 8.0.0 <9.3.19 or >= 9.4.0 <9.4.3 or >=8.0.0 and <9.3.19 or >=9.4.0 and <9.4.3 | 9.3.19, 9.4.3 |
| CVE-2025-31675 | Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability | medium | 5.4 | >= 8.0.0 < 10.3.14 or >= 10.4.0 < 10.4.5 or >= 11.0.0 < 11.0.13 or >= 11.1.0 < 11.1.5 or >=8.0.0 and <10.3.14 or >=10.4.0 and <10.4.5 or >=11.0.0 and <11.0.13 or >=11.1.0 and <11.1.5 | 10.3.14, 10.4.5, 11.0.13, 11.1.5 |
| CVE-2024-11941 | The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests th | high | 7.5 | >=8.0 <10.1.8 or >=10.2 <10.2.2 or >=10.1.0 and <10.1.8 or >=10.2.0 and <10.2.2 | 10.1.8, 10.2.2 |
| CVE-2020-13674 | The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under som | medium | 6.5 | >= 8.0.0 <8.9.19 or >= 9.1.0 <9.1.13 or >=9.2.0 <9.2.6 or >=8.0.0 and <8.9.19 or >=9.1.0 and <9.1.13 or >=9.2.0 and <9.2.6 | 8.9.19, 9.1.13, 9.2.6 |
| CVE-2022-25274 | Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated | medium | 5.4 | >= 9.3.0 <9.3.12 or >=9.3.0 and <9.3.12 | 9.3.12 |
| CVE-2024-55634 | Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. | medium | 0.0 | >= 8.0.0 < 10.2.11 or >= 10.3.0 < 10.3.9 or >= 11.0.0 < 11.0.8 or >=8.0.0 and <10.2.11 or >=10.3.0 and <10.3.9 or >=11.0.0 and <11.0.8 | 10.2.11, 10.3.9, 11.0.8 |
| CVE-2026-6366 | Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists | medium | 6.6 | >= 8.0.0 < 10.5.9 or >= 10.6.0 < 10.6.7 or >= 11.0.0 < 11.2.11 or >= 11.3.0 < 11.3.7 or >=8.0.0 and <10.5.9 or >=10.6.0 and <10.6.7 or >=11.0.0 and <11.2.11 or >=11.3.0 and <11.3.7 | 10.5.9, 10.6.7, 11.2.11, 11.3.7 |
| CVE-2024-11942 | Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the enti | medium | 5.9 | >=10.0 < 10.2.10 or >=10.0.0 and <10.2.10 | 10.2.10 |
| CVE-2026-55803 | [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) added protection for fields that store serialized data to di | unknown | 0.0 | <10.5.12 or >=10.6.0 <10.6.11 or >=11.2.0 <11.2.14 or >=11.3.0 <11.3.12 or 11.0.* or 11.1.* | 10.5.12, 10.6.11, 11.2.14, 11.3.12 |
| CVE-2026-55804 | Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists | unknown | 0.0 | <10.5.12 or >=10.6.0 <10.6.11 or >=11.2.0 <11.2.14 or >=11.3.0 <11.3.12 or 11.0.* or 11.1.* | 10.5.12, 10.6.11, 11.2.14, 11.3.12 |
| CVE-2025-13080 | Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HT | low | 0.0 | >= 8.0.0 < 10.4.9 or >= 10.5.0 < 10.5.6 or >= 11.0.0 < 11.1.9 or >= 11.2.0 < 11.2.8 or >=8.0.0 and <10.4.9 or >=10.5.0 and <10.5.6 or >=11.0.0 and <11.1.9 or >=11.2.0 and <11.2.8 | 10.4.9, 10.5.6, 11.1.9, 11.2.8 |
| CVE-2026-55806 | Drupal core ships a `rebuild.php` front controller that can be used to rebuild Drupal (clearing the caches and rebuildin | unknown | 0.0 | <10.5.12 or >=10.6.0 <10.6.11 or >=11.2.0 <11.2.14 or >=11.3.0 <11.3.12 or 11.0.* or 11.1.* | 10.5.12, 10.6.11, 11.2.14, 11.3.12 |
| CVE-2024-12393 | Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status mes | medium | 5.4 | >= 8.8.0 < 10.2.11 or >= 10.3.0 < 10.3.9 or >= 11.0.0 < 11.0.8 or >=8.8.0 and <10.2.11 or >=10.3.0 and <10.3.9 or >=11.0.0 and <11.0.8 | 10.2.11, 10.3.9, 11.0.8 |
| CVE-2025-31673 | Bulk operations allow authorized users to modify several nodes at once from the Content page (`/admin/content`). A site | medium | 4.6 | >= 8.0.0 < 10.3.13 or >= 10.4.0 < 10.4.3 or >= 11.0.0 < 11.0.12 or >= 11.1.0 < 11.1.3 or >=8.0.0 and <10.3.13 or >=10.4.0 and <10.4.3 or >=11.0.0 and <11.0.12 or >=11.1.0 and <11.1.3 | 10.3.13, 10.4.3, 11.0.12, 11.1.3 |
| CVE-2025-3057 | Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Sc | medium | 6.1 | >= 8.0.0 < 10.3.13 or >= 10.4.0 < 10.4.3 or >= 11.0.0 < 11.0.12 or >= 11.1.0 < 11.1.3 or >=8.0.0 and <10.3.13 or >=10.4.0 and <10.4.3 or >=11.0.0 and <11.0.12 or >=11.1.0 and <11.1.3 | 10.3.13, 10.4.3, 11.0.12, 11.1.3 |
| CVE-2025-13081 | Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the | medium | 5.9 | >= 8.0.0 < 10.4.9 or >= 10.5.0 < 10.5.6 or >= 11.0.0 < 11.1.9 or >= 11.2.0 < 11.2.8 or >=8.0.0 and <10.4.9 or >=10.5.0 and <10.5.6 or >=11.0.0 and <11.1.9 or >=11.2.0 and <11.2.8 | 10.4.9, 10.5.6, 11.1.9, 11.2.8 |
| CVE-2025-13083 | The core `system` module handles downloads of private and temporary files. Contrib modules can define additional kinds o | low | 3.7 | >= 8.0.0 < 10.4.9 or >= 10.5.0 < 10.5.6 or >= 11.0.0 < 11.1.9 or >= 11.2.0 < 11.2.8 or >=8.0.0 and <10.4.9 or >=10.5.0 and <10.5.6 or >=11.0.0 and <11.1.9 or >=11.2.0 and <11.2.8 or >=7.0 and <7.103 | 10.4.9, 10.5.6, 11.1.9, 11.2.8 |
| CVE-2026-55808 | The JSON:API and REST modules allow you to upload image files to image fields. The validation rules check the file exte | unknown | 0.0 | <10.5.12 or >=10.6.0 <10.6.11 or >=11.2.0 <11.2.14 or >=11.3.0 <11.3.12 or 11.0.* or 11.1.* | 10.5.12, 10.6.11, 11.2.14, 11.3.12 |
| CVE-2020-13673 | The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, t | unknown | 0.0 | >= 8.0.0 <8.9.19 or >= 9.1.0 <9.1.13 or >=9.2.0 <9.2.6 | 8.9.19, 9.1.13, 9.2.6 |
| CVE-2025-13082 | By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement. The defacemen | low | 0.0 | >= 8.0.0 < 10.4.9 or >= 10.5.0 < 10.5.6 or >= 11.0.0 < 11.1.9 or >= 11.2.0 < 11.2.8 or >=8.0.0 and <10.4.9 or >=10.5.0 and <10.5.6 or >=11.0.0 and <11.1.9 or >=11.2.0 and <11.2.8 | 10.4.9, 10.5.6, 11.1.9, 11.2.8 |
| CVE-2026-55805 | The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-sit | unknown | 0.0 | <10.6.13 or >=11.3.0 <11.3.14 or >=11.4.0 <11.4.4 or 11.0.* or 11.1.* or 11.2.* | 10.6.13, 11.3.14, 11.4.4 |
| CVE-2026-55807 | The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via `provide | unknown | 0.0 | <10.5.12 or >=10.6.0 <10.6.11 or >=11.2.0 <11.2.14 or >=11.3.0 <11.3.12 or 11.0.* or 11.1.* | 10.5.12, 10.6.11, 11.2.14, 11.3.12 |
| CVE-2026-6365 | Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can l | medium | 6.1 | >= 8.0.0 < 10.5.9 or >= 10.6.0 < 10.6.7 or >= 11.0.0 < 11.2.11 or >= 11.3.0 < 11.3.7 or >=8.0.0 and <10.5.9 or >=10.6.0 and <10.6.7 or >=11.0.0 and <11.2.11 or >=11.3.0 and <11.3.7 | 10.5.9, 10.6.7, 11.2.11, 11.3.7 |
| CVE-2026-15917 | Drupal core 11.2 and above integrate the HTMX JavaScript library. Drupal core's XSS filter does not sufficiently saniti | unknown | 0.0 | >=11.3.0 <11.3.14 or >=11.4.0 <11.4.4 or 11.2.* | 11.3.14, 11.4.4 |
| CVE-2026-6367 | Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5. The suggestions ar | medium | 6.1 | >= 11.3.0 < 11.3.7 or >=11.3.0 and <11.3.7 | 11.3.7 |
| CVE-2026-15916 | The Image module allows you to define and configure image fields. The module doesn't sufficiently check access to image | unknown | 0.0 | <10.6.13 or >=11.3.0 <11.3.14 or >=11.4.0 <11.4.4 or 11.0.* or 11.1.* or 11.2.* | 10.6.13, 11.3.14, 11.4.4 |
| GHSA-98h9-727m-44qv | Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar | high | 8.1 | >=7.0.0 and <7.69 or >=8.0.0 and <8.7.11 or >=8.8.0 and <8.8.1 | 7.69, 8.7.11, 8.8.1 |
| GHSA-gxxj-g9v8-w28p | Drupal core Arbitrary PHP code execution | high | 7.8 | >=7.0.0 and <7.75 or >=8.0.0 and <8.8.12 or >=8.9.0 and <8.9.10 or >=9.0.0 and <9.0.9 | 7.75, 8.8.12, 8.9.10, 9.0.9 |
| GHSA-7gwj-7fhm-vw4w | Drupal core unrestricted file upload | medium | 6.6 | >=8.0.0 and <8.7.11 or >=8.8.0 and <8.8.1 | 8.7.11, 8.8.1 |
| GHSA-gfvf-2f25-f34r | Drupal Anonymous Open Redirect | medium | 5.8 | >=8.0.0 and <8.5.8 or >=8.6.0 and <8.6.2 | 8.5.8, 8.6.2 |
| GHSA-pr99-c33p-fwf6 | Drupal core Denial of Service | medium | 5.3 | >=8.0.0 and <8.7.11 or >=8.8.0 and <8.8.1 | 8.7.11, 8.8.1 |
| GHSA-vfgc-c76h-mwh4 | Drupal core Cross-Site Scripting (XSS) vulnerabilities | medium | 5.3 | >=8.0.0 and <8.9.18 or >=9.1.0 and <9.1.12 or >=9.2.0 and <9.2.4 | 8.9.18, 9.1.12, 9.2.4 |
| GHSA-6gf6-24h2-66j4 | Drupal core Open Redirect vulnerability | medium | 4.3 | >=7.0.0 and <7.70 | 7.70 |
| GHSA-mh4h-27gq-cxwj | Drupal core Access bypass | medium | 4.3 | >=8.0.0 and <8.7.11 or >=8.8.0 and <8.8.1 | 8.7.11, 8.8.1 |
| GHSA-v273-j5hq-26xp | Drupal core uses a vulnerable Third-party library CKEditor | medium | 4.2 | >=8.0.0 and <8.7.12 or >=8.8.0 and <8.8.4 | 8.7.12, 8.8.4 |
| 2018-10-17-1 | Content moderation - Moderately critical - Access bypass | unknown | 0.0 | >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.5.8 or >=8.6.0 and <8.6.2 | 8.5.8, 8.6.2 |
| 2018-10-17-2 | External URL injection through URL aliases - Moderately Critical - Open Redirect | unknown | 0.0 | >=7.0 and <7.60 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.5.8 or >=8.6.0 and <8.6.2 | 7.60, 8.5.8, 8.6.2 |
| 2018-10-17-3 | Anonymous Open Redirect - Moderately Critical - Open Redirect | unknown | 0.0 | >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.5.8 or >=8.6.0 and <8.6.2 | 8.5.8, 8.6.2 |
| 2018-10-17-4 | Injection in DefaultMailSystem::mail() - Critical - Remote Code Execution | unknown | 0.0 | >=7.0 and <7.60 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.5.8 or >=8.6.0 and <8.6.2 | 7.60, 8.5.8, 8.6.2 |
| 2018-10-17-5 | Contextual Links validation - Critical - Remote Code Execution | unknown | 0.0 | >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.5.8 or >=8.6.0 and <8.6.2 | 8.5.8, 8.6.2 |
| 2019-12-18-1 | Drupal core - Moderately critical - Denial of Service - SA-CORE-2019-009 | unknown | 0.0 | >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.7.11 or >=8.8.0 and <8.8.1 | 8.7.11, 8.8.1 |
| 2019-12-18-2 | Drupal core - Moderately critical - Multiple vulnerabilities - SA-CORE-2019-010 | unknown | 0.0 | >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.7.11 or >=8.8.0 and <8.8.1 | 8.7.11, 8.8.1 |
| 2019-12-18-3 | Drupal core - Moderately critical - Access bypass - SA-CORE-2019-011 | unknown | 0.0 | >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.7.11 or >=8.8.0 and <8.8.1 | 8.7.11, 8.8.1 |
| 2019-12-18-4 | Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2019-012 | unknown | 0.0 | >=7.0.0 and <7.69 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.7.11 or >=8.8.0 and <8.8.1 | 7.69, 8.7.11, 8.8.1 |
| 2020-03-18 | Drupal core - Moderately critical - Third-party library - SA-CORE-2020-001 | unknown | 0.0 | >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.7.12 or >=8.8.0 and <8.8.4 | 8.7.12, 8.8.4 |
| 2020-05-20-1 | Drupal core - Moderately critical - Open Redirect - SA-CORE-2020-003 | unknown | 0.0 | >=7.0.0 and <7.70 | 7.70 |
| 2020-11-25 | Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-013 | unknown | 0.0 | >=7.0.0 and <7.74 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.8.0 or >=8.8.0 and <8.8.11 or >=8.9.0 and <8.9.9 or >=9.0.0 and <9.0.8 | 7.74, 8.8.11, 8.9.9, 9.0.8 |
| 2021-05-26 | Drupal core - Moderately critical - Third-party libraries - SA-CORE-2021-005 | unknown | 0.0 | >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.8.0 or >=8.8.0 and <8.9.0 or >=8.9.0 and <8.9.16 or >=9.0.0 and <9.1.0 or >=9.1.0 and <9.1.12 or >=9.2.0 and <9.2.4 | 8.9.16, 9.1.12, 9.2.4 |
| 2024-01-17 | Drupal core - Moderately critical - Denial of Service | unknown | 0.0 | >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.8.0 or >=8.8.0 and <8.9.0 or >=8.9.0 and <9.0.0 or >=9.0.0 and <9.1.0 or >=9.1.0 and <9.2.0 or >=9.2.0 and <9.3.0 or >=9.3.0 and <9.4.0 or >=9.4.0 and <9.5.0 or >=9.5.0 and <10.0.0 or >=10.0.0 and <10.1.0 or >=10.1.0 and <10.1.8 or >=10.2.0 and <10.2.2 | 10.1.8, 10.2.2 |
| CVE-2020-13665 | JSON:API PATCH requests may bypass validation for certain fields. By default, JSON:API works in a read-only mode which | unknown | 0.0 | >= 8.0.0 <8.8.8 or >= 8.9.0 <8.9.1 or >=9.0.0 <9.0.1 | 8.8.8, 8.9.1, 9.0.1 |
| CVE-2026-108097 | A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not direct | unknown | 0.0 | >= 8.9.0 < 10.6.19 or >= 11.0.0 < 11.3.19 or >= 11.4.0 < 11.4.10 or >= 12.0.0-alpha1 < 12.0.0-beta2 | 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2 |
| CVE-2026-108514 | The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) v | unknown | 0.0 | >= 10.3.0 < 10.6.19 or >= 11.0.0 < 11.3.19 or >= 11.4.0 < 11.4.10 or >= 12.0.0-alpha1 < 12.0.0-beta2 | 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2 |
| CVE-2026-108515 | The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not | unknown | 0.0 | >= 8.9.0 < 10.6.19 or >= 11.0.0 < 11.3.19 or >= 11.4.0 < 11.4.10 or >= 12.0.0-alpha1 < 12.0.0-beta2 | 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2 |
| DRUPAL-CORE-2018-001 | This security advisory fixes multiple vulnerabilities in both Drupal 7 and Drupal 8. See below for a list. #### Comment | unknown | 0.0 | >= 8.0.0 <8.4.5 | 8.4.5 |
| DRUPAL-CORE-2019-005 | This security release fixes third-party dependencies included in or required by Drupal core. * [CVE-2019-10909: Escape | unknown | 0.0 | >= 8.0.0 <8.5.15 or >=8.6.0 <8.6.15 | 8.5.15, 8.6.15 |
| DRUPAL-CORE-2019-009 | A visit to `install.php` can cause cached data to become corrupted. This could cause a site to be impaired until caches | unknown | 0.0 | >= 8.0.0 <8.7.11 or >= 8.8.0 <8.8.1 | 8.7.11, 8.8.1 |
| DRUPAL-CORE-2019-010 | Drupal 8 core's `file_save_upload()` function does not strip the leading and trailing dot ('.') from filenames, like Dru | unknown | 0.0 | >= 8.0.0 <8.7.11 or >= 8.8.0 <8.8.1 | 8.7.11, 8.8.1 |
| DRUPAL-CORE-2019-011 | The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in | unknown | 0.0 | >= 8.0.0 <8.7.11 or >= 8.8.0 <8.8.1 | 8.7.11, 8.8.1 |
| DRUPAL-CORE-2019-012 | The Drupal project uses the third-party library [Archive\_Tar](https://pear.php.net/package/Archive_Tar/), which has rel | unknown | 0.0 | >= 8.0.0 <8.7.11 or >= 8.8.0 <8.8.1 | 8.7.11, 8.8.1 |
| DRUPAL-CORE-2020-001 | The Drupal project uses the third-party library [CKEditor](https://github.com/ckeditor/ckeditor4), which has released a | unknown | 0.0 | >= 8.0.0 <8.7.12 or >= 8.8.0 <8.8.4 | 8.7.12, 8.8.4 |
| DRUPAL-CORE-2020-002 | The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all p | unknown | 0.0 | >= 8.0.0 <8.7.14 or >= 8.8.0 <8.8.6 | 8.7.14, 8.8.6 |
| DRUPAL-CORE-2021-001 | The Drupal project uses the pear Archive\_Tar library, which has released a security update that impacts Drupal. For mor | unknown | 0.0 | >= 8.0.0 <8.9.13 or >= 9.0.0 <9.0.11 or >=9.1.0 <9.1.3 | 8.9.13, 9.0.11, 9.1.3 |
| DRUPAL-CORE-2021-005 | The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4), library for WYSIWYG editing. CKEditor has | unknown | 0.0 | >= 8.0.0 <8.9.18 or >= 9.1.0 <9.1.12 or >=9.2.0 <9.2.4 | 8.9.18, 9.1.12, 9.2.4 |
| DRUPAL-CORE-2021-011 | The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4) library for WYSIWYG editing. CKEditor has | unknown | 0.0 | >= 8.0.0 <8.9.20 or >= 9.1.0 <9.1.14 or >=9.2.0 <9.2.9 | 8.9.20, 9.1.14, 9.2.9 |
| DRUPAL-CORE-2022-001 | jQuery UI is a third-party library used by Drupal. This library was previously thought to be end-of-life. Late in 2021, | unknown | 0.0 | >= 8.0.0 <9.2.11 or >= 9.3.0 <9.3.3 | 9.2.11, 9.3.3 |
| DRUPAL-CORE-2023-001 | The Media Library module does not properly check entity access in some circumstances. This may result in users with acce | unknown | 0.0 | >=8.0.0 <9.4.10 or >=9.5.0 <9.5.2 or >=10.0.0 <10.0.2 | 9.4.10, 9.5.2, 10.0.2 |
| DRUPAL-CORE-2023-002 | The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails | unknown | 0.0 | >=8.0.0 <9.4.12 or >=9.5.0 <9.5.5 or >=10.0.0 <10.0.5 | 9.4.12, 9.5.5, 10.0.5 |
| DRUPAL-CORE-2023-003 | The language module provides a Language switcher block which can be placed to provide links to quickly switch between di | unknown | 0.0 | >=8.0.0 <9.4.12 or >=9.5.0 <9.5.5 or >=10.0.0 <10.0.5 | 9.4.12, 9.5.5, 10.0.5 |
| DRUPAL-CORE-2023-004 | Drupal core provides a page that outputs the markup from `phpinfo()` to assist with diagnosing PHP configuration. If an | unknown | 0.0 | >=8.0.0 <9.4.12 or >=9.5.0 <9.5.5 or >=10.0.0 <10.0.5 | 9.4.12, 9.5.5, 10.0.5 |
| DRUPAL-CORE-2026-013 | The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing. CKEditor has | unknown | 0.0 | >=10.5.0 <10.6.17 or >=11.0.0 <11.3.17 or >=11.4.0 <11.4.7 | 10.6.17, 11.3.17, 11.4.7 |
| GHSA-6ccv-8fgf-cjpw | Drupal core Denial of Service vulnerability | medium | 0.0 | >=8.0.0 and <10.1.8 or >=10.2.0 and <10.2.2 | 10.1.8, 10.2.2 |
| GHSA-6mgp-v5cm-ghg5 | Drupal core Remote Code Execution | critical | 0.0 | >=7.0 and <7.60 or >=8.0.0 and <8.5.8 or >=8.6.0 and <8.6.2 | 7.60, 8.5.8, 8.6.2 |
| GHSA-7f4f-p7mq-p4fv | Drupal External URL injection through URL aliases leading to Open Redirect | medium | 0.0 | >=7.0 and <7.60 or >=8.0.0 and <8.5.8 or >=8.6.0 and <8.6.2 | 7.60, 8.5.8, 8.6.2 |
| GHSA-7v68-3pr5-h3cr | Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution | critical | 0.0 | >=8.0.0 and <8.5.8 or >=8.6.0 and <8.6.2 | 8.5.8, 8.6.2 |
| GHSA-f84q-mgj9-8jfc | Drupal Content moderation Access bypass | medium | 0.0 | >=8.0.0 and <8.5.8 or >=8.6.0 and <8.6.2 | 8.5.8, 8.6.2 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked