Skip to content
OpenAdvisories

Vendor

Drupal

585 known vulnerabilities.

Products

Drupal core 60 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 Drupal 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2
All Critical High Medium Low Exploited only Public exploit

585 results · Feed

  • Medium 6.8
    CVE-2025-31680

    Matomo Analytics - Moderately critical - Cross site request forgery - SA-CONTRIB-2025-008

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 before 1.24.0.

    Drupal Matomo Analytics drupal/matomo Packagist
  • Medium 6.1
    CVE-2025-31679

    Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS).This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4.

    Drupal Ignition Error Pages drupal/ignition Packagist
  • High 8.2
    CVE-2025-31678

    AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 8.8
    CVE-2025-31677

    AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Intelligence): from 1.0.0 before 1.0.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 8.8
    CVE-2025-31676

    Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001

    Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.

    Drupal Email TFA drupal/email_tfa Packagist
  • Medium 5.4
    CVE-2025-31675

    Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before…

    Drupal Drupal core Link drupal/core Web / CMS Packagist
  • High 7.5
    CVE-2025-31674

    Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 1…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 4.6
    CVE-2025-31673

    Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

    Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.1
    CVE-2025-3057

    Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.3
    CVE-2024-13312

    Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076

    Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9.

    Drupal Open Social
  • High 7.3
    CVE-2024-13311

    Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075

    Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*.

    Drupal Allow All File Extensions for file fields drupal/all_extensions Packagist
  • Medium 6.5
    CVE-2024-13310

    Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074

    Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: *.*.

    Drupal Git Utilities for Drupal drupal/git_utils Web / CMS Packagist
  • Medium 5.4
    CVE-2024-13309

    Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073

    Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1.

    Drupal Login Disable drupal/login_disable Packagist
  • Low 3.8
    CVE-2024-13308

    Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.

    Drupal Browser Back Button drupal/browser_back_button Packagist
  • Medium 4.8
    CVE-2024-13305

    Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.

    Drupal Entity Form Steps drupal/entity_form_steps Packagist
  • Medium 4.5
    CVE-2024-13304

    Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.

    Drupal Minify JS drupal/minifyjs Packagist
  • Medium 5.3
    CVE-2024-13303

    Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069

    Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2.

    Drupal Download All Files drupal/download_all_files Packagist
  • Medium 5.3
    CVE-2024-13302

    Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068

    Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3.

    Drupal Pages Restriction Access drupal/pages_restriction Packagist
  • Medium 6.1
    CVE-2024-13301

    OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sig…

    Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) drupal/miniorange_oauth_client Packagist
  • Medium 6.6
    CVE-2024-13300

    Print Anything - Critical - Unsupported - SA-CONTRIB-2024-066

    Vulnerability in Drupal Print Anything.This issue affects Print Anything: *.*.

    Drupal Print Anything
  • Medium 6.6
    CVE-2024-13299

    Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065

    Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*.

    Drupal Megamenu Framework
  • Medium 4.8
    CVE-2024-13298

    Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5.

    Drupal Tarte au Citron drupal/tarte_au_citron Packagist
  • Medium 6.6
    CVE-2024-13297

    Eloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-063

    Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.

    Drupal Eloqua
  • Medium 6.6
    CVE-2024-13296

    Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062

    Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.

    Drupal Mailjet drupal/mailjet Packagist
  • Medium 6.6
    CVE-2024-13295

    Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061

    Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.

    Drupal Node export
  • Medium 5.4
    CVE-2024-13294

    POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This issue affects POST File: from 0.0.0 before 1.0.2.

    Drupal POST File drupal/postfile Packagist
  • Low 3.1
    CVE-2024-13293

    POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2.

    Drupal POST File drupal/postfile Packagist
  • Medium 4.8
    CVE-2024-13292

    Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tooltip allows Cross-Site Scripting (XSS).This issue affects Tooltip: from 0.0.0 before 1.1.2.

    Drupal Tooltip drupal/tooltip Packagist
  • High 7.3
    CVE-2024-13291

    Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057

    Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.

    Drupal Basic HTTP Authentication
  • Medium 5.3
    CVE-2024-13290

    OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056

    Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.

    Drupal OhDear Integration drupal/ohdear_integration Packagist
  • Medium 5.4
    CVE-2024-13289

    Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting (XSS).This issue affects Cookiebot + GTM: from 0.0.0 before 1.0.18.

    Drupal Cookiebot + GTM drupal/cookiebot_gtm Packagist
  • Medium 4.3
    CVE-2024-13288

    Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052

    Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.

    Drupal Monster Menus drupal/monster_menus Packagist
  • Medium 5.4
    CVE-2024-13287

    Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (XSS).This issue affects Views SVG Animation: from 0.0.0 before 1.0.1.

    Drupal Views SVG Animation drupal/views_svg_animation Packagist
  • Medium 5.4
    CVE-2024-13286

    SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SVG Embed allows Cross-Site Scripting (XSS).This issue affects SVG Embed: from 0.0.0 before 2.1.2.

    Drupal SVG Embed drupal/svg_embed Packagist
  • Critical 9.8
    CVE-2024-13285

    wkhtmltopdf - Highly critical - Unsupported - SA-CONTRIB-2024-049

    Vulnerability in Drupal wkhtmltopdf.This issue affects wkhtmltopdf: *.*.

    Drupal wkhtmltopdf drupal/wkhtmltopdf Packagist
  • High 8.8
    CVE-2024-13284

    Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5.

    Drupal Gutenberg drupal/gutenberg Packagist
  • Medium 6.1
    CVE-2024-13283

    Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.9.

    Drupal Facets drupal/facets Packagist
  • High 8.8
    CVE-2024-13282

    Block permissions - Moderately critical - Access bypass - SA-CONTRIB-2024-046

    Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0.

    Drupal Block permissions drupal/block_permissions Packagist
  • Critical 9.1
    CVE-2024-13281

    Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045

    Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2.

    Drupal Monster Menus drupal/monster_menus Packagist
  • Critical 9.8
    CVE-2024-13280

    Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044

    Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.

    Drupal Persistent Login drupal/persistent_login Packagist