CVE-2016-6211 high 8.8
8.8
10y ago
Drupal Saving user accounts can sometimes grant the user all roles
debian php
CVE-2017-6381 high 8.1
8.1
9y ago
Drupal Remote code execution
php
CVE-2016-5385 high 8.1
8.1
10y ago
HTTP Proxy header vulnerability
suse fedora debian redhat +1
CVE-2016-3171 high 8.1
8.1
10y ago
Drupal arbitrary code execution
debian php
CVE-2016-3169 high 8.1
8.1
10y ago
Drupal saving user accounts can sometimes grant the user all roles
debian php
CVE-2016-3162 high 8.1
8.1
10y ago
Drupal File upload access bypass and denial of service
debian php
CVE-2020-13675 high —
8.0
5y ago
Unrestricted Upload of File with Dangerous Type in Drupal core
arch php
CVE-2020-13673 high —
8.0
5y ago
The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it i…
arch php
CVE-2020-13677 high —
8.0
5y ago
Drupal core access bypass vulnerability
arch php
CVE-2020-13676 high —
8.0
5y ago
Incorrect Authorization in Drupal core
arch php
CVE-2020-13674 high —
8.0
5y ago
Cross-Site Request Forgery in Drupal core
arch php
CVE-2021-33829 high —
8.0
5y ago
ckeditor4 vulnerable to cross-site scripting
arch debian ruby php +1
CVE-2017-6919 high 7.5
7.5
9y ago
Drupal access control bypass vulnerability
php
CVE-2017-6379 high 7.5
7.5
9y ago
Drupal Cross-Site Request Forgery (CSRF)
php
CVE-2017-6377 high 7.5
7.5
9y ago
Drupal editor module incorrectly checks access to inline private files
php
CVE-2016-9450 high 7.5
7.5
10y ago
Drupal Incorrect cache context on password reset page
arch php
CVE-2016-3165 high 7.5
7.5
10y ago
Drupal Form API ignores access restrictions on submit buttons
php
CVE-2016-3163 high 7.5
7.5
10y ago
Drupal Brute force amplification attacks via XML-RPC
debian php
CVE-2011-2687 high —
7.5
15y ago
Drupal Access Control Bypass
php
CVE-2016-3167 high 7.4
7.4
10y ago
Drupal Open redirect vulnerability in the drupal_goto function
debian php
CVE-2016-3164 high 7.4
7.4
10y ago
Drupal Open Redirect
debian php
CVE-2020-28949 medium —
7.0
6y ago
Moderate: php:7.4 security update
rockylinux debian php
CVE-2016-9451 medium 6.8
6.8
10y ago
Drupal Open Redirect
arch php
CVE-2026-6366 medium 6.6
6.6
8d ago
Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a …
php
CVE-2016-9452 medium 6.5
6.5
10y ago
Drupal Denial of service via transliterate mechanism
arch php
CVE-2016-3168 medium 6.4
6.4
10y ago
Drupal Reflected file download vulnerability
debian php
CVE-2026-6367 medium 6.1
6.1
8d ago
Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5.
The suggestions aren't sufficiently sanitized and a malicious user could trigger a stored cross s…
php
CVE-2026-6365 medium 6.1
6.1
8d ago
Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which which can lead to a cross-site scripting (XSS) vulnerability.
php
CVE-2016-7571 medium 6.1
6.1
10y ago
Drupal Cross-site scripting (XSS) vulnerability
php
CVE-2016-3166 medium 5.9
5.9
10y ago
Drupal CRLF injection vulnerability in the drupal_set_header function
debian php
CVE-2021-32610 medium —
5.5
5y ago
Moderate: php:7.4 security, bug fix, and enhancement update
arch rockylinux debian php
CVE-2020-28948 medium —
5.5
6y ago
Moderate: php:7.4 security update
rockylinux debian php
CVE-2019-11358 medium —
5.5
7y ago
Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update
arch rockylinux debian ruby +5
CVE-2016-6212 medium 5.3
5.3
10y ago
Drupal Views can allow unauthorized users to see Statistics information
php
CVE-2016-3170 medium 5.3
5.3
10y ago
Drupal sensitive information disclosure
debian php
CVE-2016-9449 medium 4.3
4.3
10y ago
Drupal sensitive information disclosure
arch php
CVE-2016-7572 medium 4.3
4.3
10y ago
Drupal Unprivileged access to config export
php
CVE-2016-7570 medium 4.3
4.3
10y ago
Drupal Users without "Administer comments" can set comment visibility on nodes they can edit
php
CVE-2022-39261 unknown —
—
4y ago
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a us…
debian php