Skip to content
OpenAdvisories

Vendor

Drupal

585 known vulnerabilities.

Products

Drupal core 60 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 Drupal 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2
All Critical High Medium Low Exploited only Public exploit

389 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-13080

    Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.1
    CVE-2025-12083

    CivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.

    Drupal CivicTheme Design System drupal/civictheme Packagist
  • Medium 5.3
    CVE-2025-10929

    Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111

    Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.

    Drupal Reverse Proxy Header drupal/reverse_proxy_header Packagist
  • Medium 6.5
    CVE-2025-10930

    Currency - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-110

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0.

    Drupal Currency drupal/currency Packagist
  • Medium 6.3
    CVE-2025-10928

    Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-108

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.

    Drupal Access code drupal/access_code Packagist
  • Medium 6.1
    CVE-2025-10927

    Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2.

    Drupal Plausible tracking drupal/plausible_tracking Packagist
  • Medium 6.1
    CVE-2025-10926

    JSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This issue affects JSON Field: from 0.0.0 before 1.5.

    Drupal JSON Field drupal/json_field Packagist
  • Medium 5.3
    CVE-2025-9554

    Owl Carousel 2 - Critical - Unsupported - SA-CONTRIB-2025-104

    Vulnerability in Drupal Owl Carousel 2.This issue affects Owl Carousel 2: *.*.

    Drupal Owl Carousel 2 drupal/owlcarousel2 Packagist
  • Medium 5.3
    CVE-2025-9553

    API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103

    Vulnerability in Drupal API Key manager.This issue affects API Key manager: *.*.

    Drupal API Key manager drupal/api_key_manager Packagist
  • Medium 5.3
    CVE-2025-9552

    Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102

    Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules: *.*.

    Drupal Synchronize composer.json With Contrib Modules drupal/sync_composer_with_contrib Packagist
  • Medium 6.5
    CVE-2025-9551

    Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.

    Drupal Protected Pages drupal/protected_pages Packagist
  • Medium 6.1
    CVE-2025-9550

    Facets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

    Drupal Facets drupal/facets Packagist
  • Medium 6.5
    CVE-2025-9549

    Facets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099

    Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

    Drupal Facets drupal/facets Packagist
  • Medium 4.3
    CVE-2025-8996

    Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097

    Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.This issue affects Layout Builder Advanced Permissions: from 0.0.0 before 2.2.0.

    Drupal Layout Builder Advanced Permissions drupal/layout_builder_perms Packagist
  • Medium 4.7
    CVE-2025-8675

    AI SEO Link Advisor - Less critical - Server-side Request Forgery - SA-CONTRIB-2025-095

    Server-Side Request Forgery (SSRF) vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.This issue affects AI SEO Link Advisor: from 0.0.0 before 1.0.6.

    Drupal AI SEO Link Advisor drupal/ai_seo_link_advisor Packagist
  • Medium 4.3
    CVE-2025-8362

    GoogleTag Manager - Moderately critical - Cross-site scripting - SA-CONTRIB-2025-094

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GoogleTag Manager allows Cross-Site Scripting (XSS).This issue affects GoogleTag Manager: from 0.0.0 before 1.10.0.

    Drupal GoogleTag Manager drupal/gtm Packagist
  • Medium 6.1
    CVE-2025-7716

    Real-time SEO for Drupal - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-091

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Real-time SEO for Drupal allows Cross-Site Scripting (XSS).This issue affects Real-time SEO for Drupal: from 2.0.0 before 2.2.0.

    Drupal Real-time SEO for Drupal drupal/yoast_seo Web / CMS Packagist
  • Medium 6.1
    CVE-2025-7715

    Block Attributes - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-090

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Attributes allows Cross-Site Scripting (XSS).This issue affects Block Attributes: from 0.0.0 before 1.1.0, from 2.0.0 before 2.0.1.

    Drupal Block Attributes drupal/block_attributes Packagist
  • Medium 6.1
    CVE-2025-7392

    Cookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Site Scripting (XSS).This issue affects Cookies Addons: from 1.0.0 before 1.2.4.

    Drupal Cookies Addons drupal/cookies_addons Packagist
  • Medium 5.3
    CVE-2025-7031

    Config Pages Viewer - Critical - Access bypass - SA-CONTRIB-2025-086

    Missing Authentication for Critical Function vulnerability in Drupal Config Pages Viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Config Pages Viewer: from 0.0.0 before 1.0.4.

    Drupal Config Pages Viewer drupal/config_pages_viewer Packagist
  • Medium 6.5
    CVE-2025-7030

    Two-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-085

    Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.11.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Medium 5.4
    CVE-2025-6677

    Paragraphs table - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-084

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Paragraphs table allows Cross-Site Scripting (XSS).This issue affects Paragraphs table: from 2.0.0 before 2.0.5.

    Drupal Paragraphs table drupal/paragraphs_table Packagist
  • Medium 5.4
    CVE-2025-6676

    Simple XML sitemap - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-083

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting (XSS).This issue affects Simple XML sitemap: from 0.0.0 before 4.2.2.

    Drupal Simple XML sitemap drupal/simple_sitemap Packagist
  • Medium 4.8
    CVE-2025-6675

    Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-082

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 befo…

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • Medium 6.1
    CVE-2025-6674

    CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting (XSS).This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3.

    Drupal CKEditor5 Youtube drupal/ckeditor5_youtube Packagist
  • Medium 4.3
    CVE-2025-5682

    Klaro Cookie & Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-080

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.7.

    Drupal Klaro Cookie & Consent Management drupal/klaro Packagist
  • Medium 6.1
    CVE-2025-48922

    GLightbox - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-078

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GLightbox allows Cross-Site Scripting (XSS).This issue affects GLightbox: from 0.0.0 before 1.0.16.

    Drupal GLightbox drupal/glightbox Packagist
  • Medium 6.1
    CVE-2025-48923

    Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allows Cross-Site Scripting (XSS).This issue affects Toc.Js: from 0.0.0 before 3.2.1.

    Drupal Toc.js drupal/toc_js Packagist
  • Medium 5.0
    CVE-2025-48919

    Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-073

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.

    Drupal Simple Klaro drupal/simple_klaro Packagist
  • Medium 5.0
    CVE-2025-48917

    EU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal EU Cookie Compliance (GDPR Compliance) allows Cross-Site Scripting (XSS).This issue affects EU Cookie Compliance (GDPR Compliance): from 0.0.0 before …

    Drupal EU Cookie Compliance (GDPR Compliance) drupal/eu_cookie_compliance Packagist
  • Medium 6.5
    CVE-2025-48916

    Bookable Calendar - Less critical - Access bypass - SA-CONTRIB-2025-070

    Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13.

    Drupal Bookable Calendar drupal/bookable_calendar Packagist
  • Medium 6.5
    CVE-2025-48448

    Admin Audit Trail - Less critical - Denial of Service - SA-CONTRIB-2025-068

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affects Admin Audit Trail: from 0.0.0 before 1.0.5.

    Drupal Admin Audit Trail drupal/admin_audit_trail Packagist
  • Medium 5.3
    CVE-2025-48013

    Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-065

    Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.

    Drupal Quick Node Block drupal/quick_node_block Packagist
  • Medium 5.3
    CVE-2025-48444

    Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064

    Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.

    Drupal Quick Node Block drupal/quick_node_block Packagist
  • Medium 4.8
    CVE-2025-48012

    One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063

    Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0.

    Drupal One Time Password drupal/one_time_password Packagist
  • Medium 4.8
    CVE-2025-48011

    One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.

    Drupal One Time Password drupal/one_time_password Packagist
  • Medium 4.8
    CVE-2025-48010

    One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.

    Drupal One Time Password drupal/one_time_password Packagist
  • Medium 4.8
    CVE-2025-4415

    Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2.

    Drupal Piwik PRO drupal/piwik_pro Packagist
  • Medium 6.5
    CVE-2025-47709

    Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055

    Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • Medium 4.8
    CVE-2025-47706

    Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052

    Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist