Drupal Core

• CVE-2018-7602 High 8.1 Exploited Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 99.2%
• CVE-2023-5256 High 7.5 Drupal core - Critical - Cache poisoning - SA-CORE-2023-006 0.9%
• CVE-2022-25273 High 7.5 Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values o 0.6%
• CVE-2022-25274 Medium 5.4 Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users w 0.4%
• CVE-2022-25276 Medium 6.1 The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could le 0.5%
• CVE-2022-25277 High 7.2 Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files 1.4%
• CVE-2022-25275 High 7.5 In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. A 0.7%
• CVE-2022-25278 Medium 6.5 Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by D 0.6%
• CVE-2023-31250 Medium 6.5 Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005 0.5%
• CVE-2022-25270 Unrated The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not author 0.8%
• CVE-2022-25271 Unrated Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values o 1.3%
• CVE-2020-13677 Unrated Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module 1.2%
• CVE-2020-13676 Unrated The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes 0.8%
• CVE-2020-13670 Unrated Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID 1.1%
• CVE-2020-13674 Unrated The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affec 0.5%
• CVE-2020-13675 Unrated Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might 1.4%
• CVE-2020-13672 Unrated Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions pri 0.7%
• CVE-2020-13669 Unrated Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x 0.7%
• CVE-2020-13668 Unrated Access bypass in Drupal Core 8/9 0.8%