Skip to content
Log inStart free trial

drupal/core (Packagist)

Advisories
369
Latest version
—
License
—
OpenSSF Scorecard
—

How to fix

Upgrading to 12.0.0-beta2 or later clears every advisory below that has a fix.

Upgrade commands
composer
composer require drupal/core:^12.0.0-beta2

Known vulnerabilities

AdvisorySeverityAffectedFixed in
DRUPAL-CORE-2026-016
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
 Not rated yet
EPSS 0.20%
>= 10.3.0, < 10.6.19
>= 11.0.0, < 11.3.19
>= 11.4.0, < 11.4.10
>= 12.0.0-alpha1, < 12.0.0-beta2
10.6.19
11.3.19
11.4.10
12.0.0-beta2
DRUPAL-CORE-2026-015
The Drupal core Link module provides a field type that can be used for internal and external URLs.
 Not rated yet
EPSS 0.20%
>= 8.9.0, < 10.6.19
>= 11.0.0, < 11.3.19
>= 11.4.0, < 11.4.10
>= 12.0.0-alpha1, < 12.0.0-beta2
10.6.19
11.3.19
11.4.10
12.0.0-beta2
DRUPAL-CORE-2026-014
A remote code execution vulnerability exists within the Field UI module in Drupal core.
 Not rated yet
EPSS 0.33%
>= 8.9.0, < 10.6.19
>= 11.0.0, < 11.3.19
>= 11.4.0, < 11.4.10
>= 12.0.0-alpha1, < 12.0.0-beta2
10.6.19
11.3.19
11.4.10
12.0.0-beta2
DRUPAL-CORE-2026-013
The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing.
 Not rated yet
>= 10.5.0, < 10.6.17
>= 11.0.0, < 11.3.17
>= 11.4.0, < 11.4.7
10.6.17
11.3.17
11.4.7
DRUPAL-CORE-2026-012
The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability.
 Medium
EPSS 0.23%
< 10.6.13
>= 11.3.0, < 11.3.14
>= 11.4.0, < 11.4.4
>= 11.0.0, < 11.1.0
>= 11.1.0, < 11.2.0
>= 11.2.0, < 11.3.0
10.6.13
11.1.0
11.2.0
11.3.0
11.3.14
11.4.4
DRUPAL-CORE-2026-011
Drupal core 11.2 and above integrate the HTMX JavaScript library.
 Medium
EPSS 0.21%
>= 11.3.0, < 11.3.14
>= 11.4.0, < 11.4.4
>= 11.2.0, < 11.3.0
11.3.0
11.3.14
11.4.4
DRUPAL-CORE-2026-010
The Image module allows you to define and configure image fields.
 Medium
EPSS 0.20%
< 10.6.13
>= 11.3.0, < 11.3.14
>= 11.4.0, < 11.4.4
>= 11.0.0, < 11.1.0
>= 11.1.0, < 11.2.0
>= 11.2.0, < 11.3.0
10.6.13
11.1.0
11.2.0
11.3.0
11.3.14
11.4.4
DRUPAL-CORE-2026-009
The JSON:API and REST modules allow you to upload image files to image fields.
 Medium
EPSS 0.27%
< 10.5.12
>= 10.6.0, < 10.6.11
>= 11.2.0, < 11.2.14
>= 11.3.0, < 11.3.12
>= 11.0.0, < 11.1.0
>= 11.1.0, < 11.2.0
10.5.12
10.6.11
11.1.0
11.2.0
11.2.14
11.3.12
DRUPAL-CORE-2026-008
The Media module comes with support for oEmbed.
 Low
EPSS 0.22%
< 10.5.12
>= 10.6.0, < 10.6.11
>= 11.2.0, < 11.2.14
>= 11.3.0, < 11.3.12
>= 11.0.0, < 11.1.0
>= 11.1.0, < 11.2.0
10.5.12
10.6.11
11.1.0
11.2.0
11.2.14
11.3.12
DRUPAL-CORE-2026-007
Drupal core ships a `rebuild.php` front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an…
 Medium
EPSS 0.34%
< 10.5.12
>= 10.6.0, < 10.6.11
>= 11.2.0, < 11.2.14
>= 11.3.0, < 11.3.12
>= 11.0.0, < 11.1.0
>= 11.1.0, < 11.2.0
10.5.12
10.6.11
11.1.0
11.2.0
11.2.14
11.3.12
DRUPAL-CORE-2026-006
Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site.
 Medium
EPSS 0.35%
< 10.5.12
>= 10.6.0, < 10.6.11
>= 11.2.0, < 11.2.14
>= 11.3.0, < 11.3.12
>= 11.0.0, < 11.1.0
>= 11.1.0, < 11.2.0
10.5.12
10.6.11
11.1.0
11.2.0
11.2.14
11.3.12
DRUPAL-CORE-2026-005
[SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) added protection for fields that store serialized data to disallow direct writes via web services.
 Medium
EPSS 0.35%
< 10.5.12
>= 10.6.0, < 10.6.11
>= 11.2.0, < 11.2.14
>= 11.3.0, < 11.3.12
>= 11.0.0, < 11.1.0
>= 11.1.0, < 11.2.0
10.5.12
10.6.11
11.1.0
11.2.0
11.2.14
11.3.12
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Known exploited		 Critical
EPSS 89.38%
>= 11.0.0, < 11.1.10
11.1.10
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Known exploited		 Critical
EPSS 89.38%
>= 11.2.0, < 11.2.12
11.2.12
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Known exploited		 Critical
EPSS 89.38%
>= 11.3.0, < 11.3.10
11.3.10
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Known exploited		 Critical
EPSS 89.38%
>= 8.9.0, < 10.4.10
10.4.10
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Known exploited		 Critical
EPSS 89.38%
>= 10.5.0, < 10.5.10
10.5.10
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Known exploited		 Critical
EPSS 89.38%
>= 10.6.0, < 10.6.9
10.6.9
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Known exploited		 Critical
EPSS 89.38%
>= 11.0.0, < 11.1.10
11.1.10
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Known exploited		 Critical
EPSS 89.38%
>= 11.2.0, < 11.2.12
11.2.12
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Known exploited		 Critical
EPSS 89.38%
>= 11.3.0, < 11.3.10
11.3.10
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Known exploited		 Critical
EPSS 89.38%
>= 10.6.0, < 10.6.9
10.6.9
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Known exploited		 Critical
EPSS 89.38%
>= 10.5.0, < 10.5.10
10.5.10
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Known exploited		 Critical
EPSS 89.38%
>= 8.9.0, < 10.4.10
10.4.10
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Known exploited		 Critical
EPSS 89.38%
>= 8.9.0, < 10.4.10
>= 10.5.0, < 10.5.10
>= 10.6.0, < 10.6.9
>= 11.0.0, < 11.1.10
>= 11.2.0, < 11.2.12
>= 11.3.0, < 11.3.10
10.4.10
10.5.10
10.6.9
11.1.10
11.2.12
11.3.10
DRUPAL-CORE-2026-003
Drupal core allows Cross-Site Scripting (XSS)
 Medium
EPSS 0.20%
>= 11.3.0, < 11.3.7
11.3.7
DRUPAL-CORE-2026-003
Drupal core allows Cross-Site Scripting (XSS)
 Medium
EPSS 0.20%
>= 11.3.0, < 11.3.7
11.3.7
DRUPAL-CORE-2026-002
Drupal core allows Object Injection
 Medium
EPSS 0.40%
>= 8.0.0, < 10.5.9
10.5.9
DRUPAL-CORE-2026-002
Drupal core allows Object Injection
 Medium
EPSS 0.40%
>= 10.6.0, < 10.6.7
10.6.7
DRUPAL-CORE-2026-002
Drupal core allows Object Injection
 Medium
EPSS 0.40%
>= 11.0.0, < 11.2.11
11.2.11
DRUPAL-CORE-2026-002
Drupal core allows Object Injection
 Medium
EPSS 0.40%
>= 11.3.0, < 11.3.7
11.3.7
DRUPAL-CORE-2026-002
Drupal core allows Object Injection
 Medium
EPSS 0.40%
>= 8.0.0, < 10.5.9
>= 10.6.0, < 10.6.7
>= 11.0.0, < 11.2.11
>= 11.3.0, < 11.3.7
10.5.9
10.6.7
11.2.11
11.3.7
DRUPAL-CORE-2026-001
Drupal core is Vulnerable to Cross-Site Scripting
 Medium
EPSS 0.22%
>= 8.0.0, < 10.5.9
10.5.9
DRUPAL-CORE-2026-001
Drupal core is Vulnerable to Cross-Site Scripting
 Medium
EPSS 0.22%
>= 8.0.0, < 10.5.9
>= 10.6.0, < 10.6.7
>= 11.0.0, < 11.2.11
>= 11.3.0, < 11.3.7
10.5.9
10.6.7
11.2.11
11.3.7
DRUPAL-CORE-2026-001
Drupal core is Vulnerable to Cross-Site Scripting
 Medium
EPSS 0.22%
>= 10.6.0, < 10.6.7
10.6.7
DRUPAL-CORE-2026-001
Drupal core is Vulnerable to Cross-Site Scripting
 Medium
EPSS 0.22%
>= 11.0.0, < 11.2.11
11.2.11
DRUPAL-CORE-2026-001
Drupal core is Vulnerable to Cross-Site Scripting
 Medium
EPSS 0.22%
>= 11.3.0, < 11.3.7
11.3.7
DRUPAL-CORE-2025-008
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
 Low
EPSS 0.28%
>= 10.5.0, < 10.5.6
10.5.6
DRUPAL-CORE-2025-008
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
 Low
EPSS 0.28%
>= 8.0.0, < 10.4.9
10.4.9
DRUPAL-CORE-2025-008
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
 Low
EPSS 0.28%
>= 8.0.0, < 10.4.9
>= 10.5.0, < 10.5.6
>= 11.0.0, < 11.1.9
>= 11.2.0, < 11.2.8
10.4.9
10.5.6
11.1.9
11.2.8
DRUPAL-CORE-2025-008
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
 Low
EPSS 0.28%
>= 7.0, < 7.103
7.103
DRUPAL-CORE-2025-008
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
 Low
EPSS 0.28%
>= 11.2.0, < 11.2.8
11.2.8
DRUPAL-CORE-2025-008
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
 Low
EPSS 0.28%
>= 11.0.0, < 11.1.9
11.1.9
DRUPAL-CORE-2025-007
Drupal core allows Content Spoofing
 Medium
EPSS 0.24%
>= 10.5.0, < 10.5.6
10.5.6
DRUPAL-CORE-2025-007
Drupal core allows Content Spoofing
 Medium
EPSS 0.24%
>= 11.2.0, < 11.2.8
11.2.8
DRUPAL-CORE-2025-007
Drupal core allows Content Spoofing
 Medium
EPSS 0.24%
>= 11.0.0, < 11.1.9
11.1.9
DRUPAL-CORE-2025-007
Drupal core allows Content Spoofing
 Medium
EPSS 0.24%
>= 8.0.0, < 10.4.9
10.4.9
DRUPAL-CORE-2025-007
Drupal core allows Content Spoofing
 Medium
EPSS 0.24%
>= 8.0.0, < 10.4.9
>= 10.5.0, < 10.5.6
>= 11.0.0, < 11.1.9
>= 11.2.0, < 11.2.8
10.4.9
10.5.6
11.1.9
11.2.8
DRUPAL-CORE-2025-006
Drupal core allows Object Injection
 Medium
EPSS 0.28%
>= 11.0.0, < 11.1.9
11.1.9
DRUPAL-CORE-2025-006
Drupal core allows Object Injection
 Medium
EPSS 0.28%
>= 11.2.0, < 11.2.8
11.2.8
DRUPAL-CORE-2025-006
Drupal core allows Object Injection
 Medium
EPSS 0.28%
>= 10.5.0, < 10.5.6
10.5.6
DRUPAL-CORE-2025-006
Drupal core allows Object Injection
 Medium
EPSS 0.28%
>= 8.0.0, < 10.4.9
10.4.9
DRUPAL-CORE-2025-006
Drupal core allows Object Injection
 Medium
EPSS 0.28%
>= 8.0.0, < 10.4.9
>= 10.5.0, < 10.5.6
>= 11.0.0, < 11.1.9
>= 11.2.0, < 11.2.8
10.4.9
10.5.6
11.1.9
11.2.8
DRUPAL-CORE-2025-005
Drupal core allows Forceful Browsing
 Medium
EPSS 0.35%
>= 10.5.0, < 10.5.6
10.5.6
DRUPAL-CORE-2025-005
Drupal core allows Forceful Browsing
 Medium
EPSS 0.35%
>= 8.0.0, < 10.4.9
10.4.9
DRUPAL-CORE-2025-005
Drupal core allows Forceful Browsing
 Medium
EPSS 0.35%
>= 11.0.0, < 11.1.9
11.1.9
DRUPAL-CORE-2025-005
Drupal core allows Forceful Browsing
 Medium
EPSS 0.35%
>= 11.2.0, < 11.2.8
11.2.8
DRUPAL-CORE-2025-005
Drupal core allows Forceful Browsing
 Medium
EPSS 0.35%
>= 8.0.0, < 10.4.9
>= 10.5.0, < 10.5.6
>= 11.0.0, < 11.1.9
>= 11.2.0, < 11.2.8
10.4.9
10.5.6
11.1.9
11.2.8
DRUPAL-CORE-2025-004
Drupal Core Cross-Site Scripting (XSS) Vulnerability
 Medium
EPSS 0.50%
>= 8.0.0, < 10.3.14
>= 10.4.0, < 10.4.5
>= 11.0.0, < 11.0.13
>= 11.1.0, < 11.1.5
10.3.14
10.4.5
11.0.13
11.1.5
DRUPAL-CORE-2025-004
Drupal Core Cross-Site Scripting (XSS) Vulnerability
 Medium
EPSS 0.50%
>= 8.0.0, < 10.3.14
10.3.14
DRUPAL-CORE-2025-004
Drupal Core Cross-Site Scripting (XSS) Vulnerability
 Medium
EPSS 0.50%
>= 10.4.0, < 10.4.5
10.4.5
DRUPAL-CORE-2025-004
Drupal Core Cross-Site Scripting (XSS) Vulnerability
 Medium
EPSS 0.50%
>= 11.0.0, < 11.0.13
11.0.13
DRUPAL-CORE-2025-004
Drupal Core Cross-Site Scripting (XSS) Vulnerability
 Medium
EPSS 0.50%
>= 11.1.0, < 11.1.5
11.1.5
DRUPAL-CORE-2025-003
Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability
 High
EPSS 0.60%
>= 8.0.0, < 10.3.13
>= 10.4.0, < 10.4.3
>= 11.0.0, < 11.0.12
>= 11.1.0, < 11.1.3
10.3.13
10.4.3
11.0.12
11.1.3
DRUPAL-CORE-2025-003
Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability
 High
EPSS 0.60%
>= 11.1.0, < 11.1.3
11.1.3
DRUPAL-CORE-2025-003
Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability
 High
EPSS 0.60%
>= 11.0.0, < 11.0.12
11.0.12
DRUPAL-CORE-2025-003
Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability
 High
EPSS 0.60%
>= 10.4.0, < 10.4.3
10.4.3
DRUPAL-CORE-2025-003
Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability
 High
EPSS 0.60%
>= 8.0.0, < 10.3.13
10.3.13
DRUPAL-CORE-2025-002
Drupal Core Vulnerable to Forceful Browsing
 Medium
EPSS 0.32%
>= 11.1.0, < 11.1.3
11.1.3
DRUPAL-CORE-2025-002
Drupal Core Vulnerable to Forceful Browsing
 Medium
EPSS 0.32%
>= 8.0.0, < 10.3.13
>= 10.4.0, < 10.4.3
>= 11.0.0, < 11.0.12
>= 11.1.0, < 11.1.3
10.3.13
10.4.3
11.0.12
11.1.3
DRUPAL-CORE-2025-002
Drupal Core Vulnerable to Forceful Browsing
 Medium
EPSS 0.32%
>= 8.0.0, < 10.3.13
10.3.13
DRUPAL-CORE-2025-002
Drupal Core Vulnerable to Forceful Browsing
 Medium
EPSS 0.32%
>= 10.4.0, < 10.4.3
10.4.3
DRUPAL-CORE-2025-002
Drupal Core Vulnerable to Forceful Browsing
 Medium
EPSS 0.32%
>= 11.0.0, < 11.0.12
11.0.12
DRUPAL-CORE-2025-001
Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages
 Medium
EPSS 0.31%
>= 8.0.0, < 10.3.13
10.3.13
DRUPAL-CORE-2025-001
Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages
 Medium
EPSS 0.31%
>= 11.1.0, < 11.1.3
11.1.3
DRUPAL-CORE-2025-001
Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages
 Medium
EPSS 0.31%
>= 11.0.0, < 11.0.12
11.0.12
DRUPAL-CORE-2025-001
Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages
 Medium
EPSS 0.31%
>= 10.4.0, < 10.4.3
10.4.3
DRUPAL-CORE-2025-001
Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages
 Medium
EPSS 0.31%
>= 8.0.0, < 10.3.13
>= 10.4.0, < 10.4.3
>= 11.0.0, < 11.0.12
>= 11.1.0, < 11.1.3
10.3.13
10.4.3
11.0.12
11.1.3
DRUPAL-CORE-2024-008
Drupal core contains a potential PHP Object Injection vulnerability
 Critical
EPSS 0.98%
>= 8.0.0, < 10.2.11
>= 10.3.0, < 10.3.9
10.2.11
10.3.9
DRUPAL-CORE-2024-008
Drupal core contains a potential PHP Object Injection vulnerability
 Critical
EPSS 0.98%
>= 8.8.0, < 10.2.11
10.2.11
DRUPAL-CORE-2024-008
Drupal core contains a potential PHP Object Injection vulnerability
 Critical
EPSS 0.98%
>= 10.3.0, < 10.3.9
10.3.9
DRUPAL-CORE-2024-008
Drupal core contains a potential PHP Object Injection vulnerability
 Critical
EPSS 0.98%
>= 7.0, < 7.102
7.102
DRUPAL-CORE-2024-007
Drupal core contains a potential PHP Object Injection vulnerability
 Critical
EPSS 0.83%
>= 11.0.0, < 11.0.8
11.0.8
DRUPAL-CORE-2024-007
Drupal core contains a potential PHP Object Injection vulnerability
 Critical
EPSS 0.83%
>= 8.8.0, < 10.2.11
10.2.11
DRUPAL-CORE-2024-007
Drupal core contains a potential PHP Object Injection vulnerability
 Critical
EPSS 0.83%
>= 10.3.0, < 10.3.9
10.3.9
DRUPAL-CORE-2024-007
Drupal core contains a potential PHP Object Injection vulnerability
 Critical
EPSS 0.83%
>= 8.0.0, < 10.2.11
>= 10.3.0, < 10.3.9
>= 11.0.0, < 11.0.8
10.2.11
10.3.9
11.0.8
DRUPAL-CORE-2024-006
Drupal core contains a potential PHP Object Injection vulnerability
 Critical
EPSS 0.93%
>= 11.0.0, < 11.0.8
11.0.8
DRUPAL-CORE-2024-006
Drupal core contains a potential PHP Object Injection vulnerability
 Critical
EPSS 0.93%
>= 10.3.0, < 10.3.9
10.3.9
DRUPAL-CORE-2024-006
Drupal core contains a potential PHP Object Injection vulnerability
 Critical
EPSS 0.93%
>= 8.8.0, < 10.2.11
10.2.11
DRUPAL-CORE-2024-006
Drupal core contains a potential PHP Object Injection vulnerability
 Critical
EPSS 0.93%
>= 8.0.0, < 10.2.11
>= 10.3.0, < 10.3.9
>= 11.0.0, < 11.0.8
10.2.11
10.3.9
11.0.8
DRUPAL-CORE-2024-004
Drupal core Access bypass
 High
EPSS 0.41%
>= 11.0.0, < 11.0.8
11.0.8
DRUPAL-CORE-2024-004
Drupal core Access bypass
 High
EPSS 0.41%
>= 10.3.0, < 10.3.9
10.3.9
DRUPAL-CORE-2024-004
Drupal core Access bypass
 High
EPSS 0.41%
>= 8.0.0, < 10.2.11
10.2.11
DRUPAL-CORE-2024-004
Drupal core Access bypass
 High
EPSS 0.41%
>= 8.0.0, < 10.2.11
>= 10.3.0, < 10.3.9
>= 11.0.0, < 11.0.8
10.2.11
10.3.9
11.0.8
DRUPAL-CORE-2024-003
Drupal Core Cross-Site Scripting (XSS)
 Medium
EPSS 0.34%
>= 11.0.0, < 11.0.8
11.0.8
DRUPAL-CORE-2024-003
Drupal Core Cross-Site Scripting (XSS)
 Medium
EPSS 0.34%
>= 10.3.0, < 10.3.9
10.3.9
DRUPAL-CORE-2024-003
Drupal Core Cross-Site Scripting (XSS)
 Medium
EPSS 0.34%
>= 8.8.0, < 10.2.11
10.2.11
DRUPAL-CORE-2024-003
Drupal Core Cross-Site Scripting (XSS)
 Medium
EPSS 0.34%
>= 8.8.0, < 10.2.11
>= 10.3.0, < 10.3.9
>= 11.0.0, < 11.0.8
10.2.11
10.3.9
11.0.8
DRUPAL-CORE-2024-002
Drupal core vulnerable to improper error handling
 Medium
EPSS 0.39%
>= 10.0.0, < 10.2.10
10.2.10
DRUPAL-CORE-2024-002
Drupal core vulnerable to improper error handling
 Medium
EPSS 0.39%
>= 10.0.0, < 10.2.10
10.2.10
GHSA-mg8j-w93w-xjgc
Drupal Full Path Disclosure
 Medium
EPSS 9.27%
>= 10.3.0, < 10.3.6
10.3.6
GHSA-mg8j-w93w-xjgc
Drupal Full Path Disclosure
 Medium
EPSS 9.27%
>= 8.0.0, < 10.2.9
10.2.9
GHSA-mg8j-w93w-xjgc
Drupal Full Path Disclosure
 Medium
EPSS 9.27%
>= 11.0.0, < 11.0.5
11.0.5
GHSA-vfgc-c76h-mwh4
Drupal core Cross-Site Scripting (XSS) vulnerabilities
 Medium
>= 8.0.0, < 8.9.18
8.9.18
GHSA-vfgc-c76h-mwh4
Drupal core Cross-Site Scripting (XSS) vulnerabilities
 Medium
>= 9.1.0, < 9.1.12
9.1.12
GHSA-vfgc-c76h-mwh4
Drupal core Cross-Site Scripting (XSS) vulnerabilities
 Medium
>= 9.2.0, < 9.2.4
9.2.4
GHSA-gxxj-g9v8-w28p
Drupal core Arbitrary PHP code execution
 High
>= 7.0.0, < 7.75
7.75
GHSA-gxxj-g9v8-w28p
Drupal core Arbitrary PHP code execution
 High
>= 8.0.0, < 8.8.12
8.8.12
GHSA-gxxj-g9v8-w28p
Drupal core Arbitrary PHP code execution
 High
>= 8.9.0, < 8.9.10
8.9.10
GHSA-gxxj-g9v8-w28p
Drupal core Arbitrary PHP code execution
 High
>= 9.0.0, < 9.0.9
9.0.9
GHSA-6gf6-24h2-66j4
Drupal core Open Redirect vulnerability
 Medium
>= 7.0.0, < 7.70
7.70
GHSA-v273-j5hq-26xp
Drupal core uses a vulnerable Third-party library CKEditor
 Medium
>= 8.0.0, < 8.7.12
8.7.12
GHSA-v273-j5hq-26xp
Drupal core uses a vulnerable Third-party library CKEditor
 Medium
>= 8.8.0, < 8.8.4
8.8.4
GHSA-98h9-727m-44qv
Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
 High
>= 7.0.0, < 7.69
7.69
GHSA-98h9-727m-44qv
Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
 High
>= 8.8.0, < 8.8.1
8.8.1
GHSA-98h9-727m-44qv
Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
 High
>= 8.0.0, < 8.7.11
8.7.11
GHSA-mh4h-27gq-cxwj
Drupal core Access bypass
 Medium
>= 8.8.0, < 8.8.1
8.8.1
GHSA-mh4h-27gq-cxwj
Drupal core Access bypass
 Medium
>= 8.0.0, < 8.7.11
8.7.11
GHSA-7gwj-7fhm-vw4w
Drupal core unrestricted file upload
 Medium
>= 8.0.0, < 8.7.11
8.7.11
GHSA-7gwj-7fhm-vw4w
Drupal core unrestricted file upload
 Medium
>= 8.8.0, < 8.8.1
8.8.1
GHSA-pr99-c33p-fwf6
Drupal core Denial of Service
 Medium
>= 8.8.0, < 8.8.1
8.8.1
GHSA-pr99-c33p-fwf6
Drupal core Denial of Service
 Medium
>= 8.0.0, < 8.7.11
8.7.11
GHSA-7v68-3pr5-h3cr
Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution
 Critical
>= 8.6.0, < 8.6.2
8.6.2
GHSA-7v68-3pr5-h3cr
Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution
 Critical
>= 8.0.0, < 8.5.8
8.5.8
GHSA-6mgp-v5cm-ghg5
Drupal core Remote Code Execution
 Critical
>= 7.0, < 7.60
7.60
GHSA-6mgp-v5cm-ghg5
Drupal core Remote Code Execution
 Critical
>= 8.0.0, < 8.5.8
8.5.8
GHSA-6mgp-v5cm-ghg5
Drupal core Remote Code Execution
 Critical
>= 8.6.0, < 8.6.2
8.6.2
GHSA-gfvf-2f25-f34r
Drupal Anonymous Open Redirect
 Medium
>= 8.6.0, < 8.6.2
8.6.2
GHSA-gfvf-2f25-f34r
Drupal Anonymous Open Redirect
 Medium
>= 8.0.0, < 8.5.8
8.5.8
GHSA-7f4f-p7mq-p4fv
Drupal External URL injection through URL aliases leading to Open Redirect
 Medium
>= 8.6.0, < 8.6.2
8.6.2
GHSA-7f4f-p7mq-p4fv
Drupal External URL injection through URL aliases leading to Open Redirect
 Medium
>= 7.0, < 7.60
7.60
GHSA-7f4f-p7mq-p4fv
Drupal External URL injection through URL aliases leading to Open Redirect
 Medium
>= 8.0.0, < 8.5.8
8.5.8
GHSA-f84q-mgj9-8jfc
Drupal Content moderation Access bypass
 Medium
>= 8.6.0, < 8.6.2
8.6.2
GHSA-f84q-mgj9-8jfc
Drupal Content moderation Access bypass
 Medium
>= 8.0.0, < 8.5.8
8.5.8
GHSA-6ccv-8fgf-cjpw
Drupal core Denial of Service vulnerability
 Medium
>= 8.0.0, < 10.1.8
10.1.8
GHSA-6ccv-8fgf-cjpw
Drupal core Denial of Service vulnerability
 Medium
>= 10.2.0, < 10.2.2
10.2.2
DRUPAL-CORE-2024-001
Drupal core Denial of Service
 High
EPSS 0.48%
>= 10.1.0, < 10.1.8
10.1.8
DRUPAL-CORE-2024-001
Drupal core Denial of Service
 High
EPSS 0.48%
>= 10.2.0, < 10.2.2
10.2.2
DRUPAL-CORE-2024-001
Drupal core Denial of Service
 High
EPSS 0.48%
>= 8.0.0, < 10.1.8
>= 10.2.0, < 10.2.2
10.1.8
10.2.2
GHSA-62cf-jvpp-48q6
Drupal Denial of Service vulnerability
 High
EPSS 0.79%
 No fix yet
DRUPAL-CORE-2023-006
Cache poisoning in drupal/core
 High
EPSS 0.85%
>= 10.1.0, < 10.1.4
10.1.4
DRUPAL-CORE-2023-006
Cache poisoning in drupal/core
 High
EPSS 0.85%
>= 8.7.0, < 9.5.11
9.5.11
DRUPAL-CORE-2023-006
Cache poisoning in drupal/core
 High
EPSS 0.85%
>= 8.7.0, < 9.5.11
>= 10.0.0, < 10.0.11
>= 10.1.0, < 10.1.4
9.5.11
10.0.11
10.1.4
DRUPAL-CORE-2023-006
Cache poisoning in drupal/core
 High
EPSS 0.85%
>= 10.0.0, < 10.0.11
10.0.11
DRUPAL-CORE-2023-005
Access bypass in Drupal core
 Medium
EPSS 0.54%
>= 8.0.0, < 9.4.14
>= 9.5.0, < 9.5.8
>= 10.0.0, < 10.0.8
9.4.14
9.5.8
10.0.8
DRUPAL-CORE-2023-005
Access bypass in Drupal core
 Medium
EPSS 0.54%
>= 7.0.0, < 7.96
7.96
DRUPAL-CORE-2023-005
Access bypass in Drupal core
 Medium
EPSS 0.54%
>= 9.0.0, < 9.4.14
9.4.14
DRUPAL-CORE-2023-005
Access bypass in Drupal core
 Medium
EPSS 0.54%
>= 9.5.0, < 9.5.8
9.5.8
DRUPAL-CORE-2023-005
Access bypass in Drupal core
 Medium
EPSS 0.54%
>= 10.0.0, < 10.0.8
10.0.8
DRUPAL-CORE-2023-004
Drupal core provides a page that outputs the markup from `phpinfo()` to assist with diagnosing PHP configuration.
 Not rated yet
>= 8.0.0, < 9.4.12
>= 9.5.0, < 9.5.5
>= 10.0.0, < 10.0.5
9.4.12
9.5.5
10.0.5
DRUPAL-CORE-2023-003
The language module provides a Language switcher block which can be placed to provide links to quickly switch between different languages.
 Not rated yet
>= 8.0.0, < 9.4.12
>= 9.5.0, < 9.5.5
>= 10.0.0, < 10.0.5
9.4.12
9.5.5
10.0.5
DRUPAL-CORE-2023-002
The Media module does not properly check entity access in some circumstances.
 Not rated yet
>= 8.0.0, < 9.4.12
>= 9.5.0, < 9.5.5
>= 10.0.0, < 10.0.5
9.4.12
9.5.5
10.0.5
DRUPAL-CORE-2023-001
The Media Library module does not properly check entity access in some circumstances.
 Not rated yet
>= 8.0.0, < 9.4.10
>= 9.5.0, < 9.5.2
>= 10.0.0, < 10.0.2
9.4.10
9.5.2
10.0.2
DRUPAL-CORE-2022-016
Twig may load a template outside a configured directory when using the filesystem loader
 High
EPSS 3.17%
>= 8.0.0, < 9.3.22
>= 9.4.0, < 9.4.7
9.3.22
9.4.7
DRUPAL-CORE-2022-015
Lack of domain validation in Druple core
 Medium
EPSS 0.53%
>= 9.4.0, < 9.4.3
9.4.3
DRUPAL-CORE-2022-015
Lack of domain validation in Druple core
 Medium
EPSS 0.53%
>= 8.0.0, < 9.3.19
9.3.19
DRUPAL-CORE-2022-015
Lack of domain validation in Druple core
 Medium
EPSS 0.53%
>= 8.0.0, < 9.3.19
>= 9.4.0, < 9.4.3
9.3.19
9.4.3
DRUPAL-CORE-2022-014
Drupal core arbitrary PHP code execution
 High
EPSS 1.42%
>= 8.0.0, < 9.3.19
9.3.19
DRUPAL-CORE-2022-014
Drupal core arbitrary PHP code execution
 High
EPSS 1.42%
>= 9.4.0, < 9.4.3
9.4.3
DRUPAL-CORE-2022-014
Drupal core arbitrary PHP code execution
 High
EPSS 1.42%
>= 8.0.0, < 9.3.19
>= 9.4.0, < 9.4.3
9.3.19
9.4.3
DRUPAL-CORE-2022-013
Access bypass in Drupal Core
 Medium
EPSS 0.59%
>= 8.0.0, < 9.3.19
>= 9.4.0, < 9.4.3
9.3.19
9.4.3
DRUPAL-CORE-2022-013
Access bypass in Drupal Core
 Medium
EPSS 0.59%
>= 9.4.0, < 9.4.3
9.4.3
DRUPAL-CORE-2022-013
Access bypass in Drupal Core
 Medium
EPSS 0.59%
>= 8.0.0, < 9.3.19
9.3.19
DRUPAL-CORE-2022-012
Drupal core Information Disclosure vulnerability
 High
EPSS 0.67%
>= 9.4.0, < 9.4.3
9.4.3
DRUPAL-CORE-2022-012
Drupal core Information Disclosure vulnerability
 High
EPSS 0.67%
>= 8.0.0, < 9.3.19
>= 9.4.0, < 9.4.3
9.3.19
9.4.3
DRUPAL-CORE-2022-012
Drupal core Information Disclosure vulnerability
 High
EPSS 0.67%
>= 7.0.0, < 7.91
7.91
DRUPAL-CORE-2022-012
Drupal core Information Disclosure vulnerability
 High
EPSS 0.67%
>= 8.0.0, < 9.3.19
9.3.19
DRUPAL-CORE-2022-011
Failure to strip the Cookie header on change in host or HTTP downgrade
 High
EPSS 1.99%
>= 8.0.0, < 9.2.21
>= 9.3.0, < 9.3.16
9.2.21
9.3.16
DRUPAL-CORE-2022-010
Cross-domain cookie leakage in Guzzle
 High
EPSS 1.36%
>= 8.0.0, < 9.2.20
>= 9.3.0, < 9.3.14
9.2.20
9.3.14
GHSA-gjqg-9rhv-qj67
Drupal Core Open Redirect vulnerability
 Medium
EPSS 0.86%
>= 7.0.0, < 7.70
7.70
GHSA-96vx-qf28-6f8m
Drupal Access Control Bypass
 High
EPSS 3.06%
>= 7.0, < 7.3
7.3
GHSA-836p-6p4j-35cg
Drupal Open Redirect
 High
EPSS 1.92%
>= 7.0, < 7.43
7.43
GHSA-836p-6p4j-35cg
Drupal Open Redirect
 High
EPSS 1.92%
>= 8.0, < 8.0.4
8.0.4
GHSA-836p-6p4j-35cg
Drupal Open Redirect
 High
EPSS 1.92%
>= 6.0, < 6.38
6.38
GHSA-fg5q-r2q5-qmh3
Drupal CRLF injection vulnerability in the drupal_set_header function
 Medium
EPSS 1.18%
>= 6.0, < 6.38
6.38
GHSA-q3p9-8728-wq7x
Drupal saving user accounts can sometimes grant the user all roles
 High
EPSS 2.22%
>= 6.0, < 6.38
6.38
GHSA-4gh5-3hqj-x3pj
Drupal Form API ignores access restrictions on submit buttons
 High
EPSS 1.36%
>= 6.0, < 6.38
6.38
GHSA-q3p9-8728-wq7x
Drupal saving user accounts can sometimes grant the user all roles
 High
EPSS 2.22%
>= 7.0, < 7.43
7.43
GHSA-qqxc-cppg-4xp8
Drupal Reflected file download vulnerability
 Medium
EPSS 2.47%
>= 6.0, < 6.38
6.38
GHSA-qqxc-cppg-4xp8
Drupal Reflected file download vulnerability
 Medium
EPSS 2.47%
>= 7.0, < 7.43
7.43
GHSA-pqv4-xgqh-j8vh
Drupal sensitive information disclosure
 Medium
EPSS 2.09%
>= 8.0, < 8.0.4
8.0.4
GHSA-pqv4-xgqh-j8vh
Drupal sensitive information disclosure
 Medium
EPSS 2.09%
>= 7.0, < 7.43
7.43
GHSA-h3r9-pjmr-f938
Drupal Brute force amplification attacks via XML-RPC
 High
EPSS 1.43%
>= 7.0, < 7.43
7.43
GHSA-h3r9-pjmr-f938
Drupal Brute force amplification attacks via XML-RPC
 High
EPSS 1.43%
>= 6.0, < 6.38
6.38
GHSA-gxwx-c7m8-f95h
Drupal Open redirect vulnerability in the drupal_goto function
 High
EPSS 1.35%
>= 6.0, < 6.38
6.38
GHSA-w2pj-c8x5-jvg2
Drupal File upload access bypass and denial of service
 High
EPSS 1.59%
>= 7.0, < 7.43
7.43
GHSA-w2pj-c8x5-jvg2
Drupal File upload access bypass and denial of service
 High
EPSS 1.59%
>= 8.0, < 8.0.4
8.0.4
GHSA-69g8-g9jq-74v7
Drupal arbitrary code execution
 High
EPSS 3.19%
>= 6.0, < 6.38
6.38
GHSA-6g9h-6v79-w4pc
Drupal Users without "Administer comments" can set comment visibility on nodes they can edit
 Medium
EPSS 1.68%
>= 8.0.0, < 8.1.10
8.1.10
GHSA-vhg8-x858-7wq6
Drupal Cross-site scripting (XSS) vulnerability
 Medium
EPSS 1.49%
>= 8.0, < 8.1.10
8.1.10
GHSA-fmqh-2j2x-vgp3
Drupal Unprivileged access to config export
 Medium
EPSS 1.72%
>= 8.0, < 8.1.10
8.1.10
GHSA-frqf-9qr4-6vxf
Drupal Saving user accounts can sometimes grant the user all roles
 High
EPSS 2.83%
>= 7.0, < 7.44
7.44
GHSA-rfxx-gxwc-923c
Drupal Views can allow unauthorized users to see Statistics information
 Medium
EPSS 2.21%
>= 8.0, < 8.1.3
8.1.3
GHSA-jpj8-49hr-wcwv
Drupal Denial of service via transliterate mechanism
 Medium
EPSS 1.72%
>= 8.0, < 8.2.3
8.2.3
GHSA-98w5-wqp9-w466
Drupal Incorrect cache context on password reset page
 High
EPSS 1.00%
>= 8.0, < 8.2.3
8.2.3
GHSA-p745-347h-hjfw
Drupal sensitive information disclosure
 Medium
EPSS 1.90%
>= 8.0, < 8.2.3
8.2.3
GHSA-66gr-xrcf-8jpq
Drupal Open Redirect
 Medium
EPSS 1.54%
>= 7.0, < 7.52
7.52
GHSA-66gr-xrcf-8jpq
Drupal Open Redirect
 Medium
EPSS 1.54%
>= 8.0, < 8.2.3
8.2.3
GHSA-p745-347h-hjfw
Drupal sensitive information disclosure
 Medium
EPSS 1.90%
>= 7.0, < 7.52
7.52
GHSA-gxxq-fhc7-3jv9
Drupal Cross-Site Request Forgery (CSRF)
 High
EPSS 0.78%
>= 8.2.0, < 8.2.7
8.2.7
GHSA-5vpr-v24w-mmjj
Drupal cross site scripting vulnerability
 Medium
EPSS 1.22%
>= 8.0, < 8.4.0
8.4.0
GHSA-5vpr-v24w-mmjj
Drupal cross site scripting vulnerability
 Medium
EPSS 1.22%
>= 7.0, < 7.57
7.57
GHSA-wm86-w3cf-h6vm
Drupal external link injection vulnerability
 Medium
EPSS 1.17%
>= 7.0, < 7.57
7.57
GHSA-585j-5449-mf5m
Drupal cross-site scripting vulnerability
 Medium
EPSS 1.61%
>= 8.4.0, < 8.4.5
8.4.5
GHSA-585j-5449-mf5m
Drupal cross-site scripting vulnerability
 Medium
EPSS 1.61%
>= 7.0, < 7.57
7.57
GHSA-2p28-5mvp-2j2r
Drupal Comment reply form allows access to restricted content
 High
EPSS 1.21%
>= 7.0, < 7.57
7.57
GHSA-2p28-5mvp-2j2r
Drupal Comment reply form allows access to restricted content
 High
EPSS 1.21%
>= 8.4.0, < 8.4.5
8.4.5
GHSA-9c24-g32g-35rj
Drupal PECL YAML parser unsafe object handling
 Critical
EPSS 20.24%
>= 8.0, < 8.3.4
8.3.4
GHSA-7ffh-cjvg-fpr4
Drupal Settings Tray access bypass
 Medium
EPSS 1.07%
>= 8.4.0, < 8.4.5
8.4.5
GHSA-6hpj-9xj7-2jxx
Drupal access control bypass vulnerability
 High
EPSS 1.61%
>= 8.0, < 8.2.8
8.2.8
GHSA-6hpj-9xj7-2jxx
Drupal access control bypass vulnerability
 High
EPSS 1.61%
>= 8.3.0, < 8.3.1
8.3.1
GHSA-3327-jr93-7hq3
Drupal access bypass vulnerability
 High
EPSS 1.29%
>= 8.4.0, < 8.4.5
8.4.5
GHSA-66mv-q8r2-hj8w
Drupal access bypass vulnerability
 Medium
EPSS 1.02%
>= 7.0, < 7.57
7.57
GHSA-f4qx-jqfq-7785
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
 Critical
EPSS 3.02%
>= 8.0, < 8.3.7
8.3.7
GHSA-rhx9-3qf7-r3j7
Drupal Remote code execution
 High
EPSS 3.90%
>= 8.0, < 8.2.7
8.2.7
GHSA-w7qx-vwr9-2j3r
Drupal editor module incorrectly checks access to inline private files
 High
EPSS 1.89%
>= 8.2.0, < 8.2.7
8.2.7
GHSA-h377-287m-w2r9
Drupal file REST resource does not properly validate
 Medium
EPSS 1.83%
>= 8.0, < 8.3.4
8.3.4
GHSA-58f3-cx8p-h8jg
Drupal core access bypass vulnerability
 Medium
EPSS 1.95%
>= 8.0, < 8.3.4
8.3.4
GHSA-58f3-cx8p-h8jg
Drupal core access bypass vulnerability
 Medium
EPSS 1.95%
>= 7.0, < 7.56
7.56
GHSA-p8g6-5mg7-9r5q
Drupal REST API can bypass comment approval
 High
EPSS 2.10%
>= 8.0, < 8.3.7
8.3.7
GHSA-hcq9-hmgf-6qr9
Drupal SQL Injection vulnerability
 Critical
EPSS 1.06%
 No fix yet
GHSA-qp8q-gwf5-hqh2
Drupal Cross-Site Scripting vulnerability
 Medium
EPSS 1.20%
 No fix yet
DRUPAL-CORE-2022-009
Access bypass in Drupal core
 Medium
EPSS 0.42%
>= 9.3.0, < 9.3.12
9.3.12
DRUPAL-CORE-2022-009
Access bypass in Drupal core
 Medium
EPSS 0.42%
>= 9.3.0, < 9.3.12
9.3.12
DRUPAL-CORE-2022-008
Improper input validation in Drupal core
 High
EPSS 0.57%
>= 8.0.0, < 9.2.18
>= 9.3.0, < 9.3.12
9.2.18
9.3.12
DRUPAL-CORE-2022-008
Improper input validation in Drupal core
 High
EPSS 0.57%
>= 8.0.0, < 9.2.18
9.2.18
DRUPAL-CORE-2022-008
Improper input validation in Drupal core
 High
EPSS 0.57%
>= 9.3.0, < 9.3.12
9.3.12
GHSA-m6ch-gg5f-wxx3
HTTP Proxy header vulnerability
 High
EPSS 50.43%
>= 8.0, < 8.1.7
8.1.7
DRUPAL-CORE-2022-006
Improper Input Validation in guzzlehttp/psr7
 Medium
EPSS 2.48%
>= 8.0.0, < 9.2.16
>= 9.3.0, < 9.3.9
9.2.16
9.3.9
GHSA-4fc4-4p5g-6w89
Cross-site Scripting in CKEditor4
 Medium
EPSS 2.49%
>= 8.0.0, < 9.2.15
>= 9.3.0, < 9.3.8
9.2.15
9.3.8
DRUPAL-CORE-2022-004
Incorrect authorization in Drupal core
 Medium
EPSS 0.77%
>= 8.0.0, < 9.2.13
>= 9.3.0, < 9.3.6
9.2.13
9.3.6
DRUPAL-CORE-2022-004
Incorrect authorization in Drupal core
 Medium
EPSS 0.77%
>= 9.3.0, < 9.3.6
9.3.6
DRUPAL-CORE-2022-004
Incorrect authorization in Drupal core
 Medium
EPSS 0.77%
>= 8.0.0, < 9.2.13
9.2.13
DRUPAL-CORE-2022-003
Improper input validation in Drupal core
 High
EPSS 1.27%
>= 8.0.0, < 9.2.13
>= 9.3.0, < 9.3.6
9.2.13
9.3.6
DRUPAL-CORE-2022-003
Improper input validation in Drupal core
 High
EPSS 1.27%
>= 8.0.0, < 9.2.13
9.2.13
DRUPAL-CORE-2022-003
Improper input validation in Drupal core
 High
EPSS 1.27%
>= 9.3.0, < 9.3.6
9.3.6
DRUPAL-CORE-2022-003
Improper input validation in Drupal core
 High
EPSS 1.27%
>= 7.0.0, < 7.88
7.88
GHSA-m6q5-wv4x-fv6h
Cross-site Scripting in Drupal Core
 Medium
EPSS 0.79%
>= 8.0.0, < 8.8.10
8.8.10
GHSA-m6q5-wv4x-fv6h
Cross-site Scripting in Drupal Core
 Medium
EPSS 0.79%
>= 9.0.0, < 9.0.6
9.0.6
GHSA-m6q5-wv4x-fv6h
Cross-site Scripting in Drupal Core
 Medium
EPSS 0.79%
>= 8.9.0, < 8.9.6
8.9.6
DRUPAL-CORE-2022-001
jQuery UI is a third-party library used by Drupal.
 Not rated yet
>= 8.0.0, < 9.2.11
>= 9.3.0, < 9.3.3
9.2.11
9.3.3
DRUPAL-CORE-2021-011
The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4) library for WYSIWYG editing.
 Not rated yet
>= 8.0.0, < 8.9.20
>= 9.1.0, < 9.1.14
>= 9.2.0, < 9.2.9
8.9.20
9.1.14
9.2.9
DRUPAL-CORE-2021-010
Drupal core access bypass vulnerability
 High
EPSS 1.22%
>= 9.2.0, < 9.2.6
9.2.6
DRUPAL-CORE-2021-010
Drupal core access bypass vulnerability
 High
EPSS 1.22%
>= 8.0.0, < 8.9.19
>= 9.1.0, < 9.1.13
>= 9.2.0, < 9.2.6
8.9.19
9.1.13
9.2.6
DRUPAL-CORE-2021-010
Drupal core access bypass vulnerability
 High
EPSS 1.22%
>= 8.0.0, < 8.9.19
8.9.19
DRUPAL-CORE-2021-010
Drupal core access bypass vulnerability
 High
EPSS 1.22%
>= 9.1.0, < 9.1.13
9.1.13
DRUPAL-CORE-2021-009
Incorrect Authorization in Drupal core
 Medium
EPSS 0.80%
>= 8.0.0, < 8.9.19
>= 9.1.0, < 9.1.13
>= 9.2.0, < 9.2.6
8.9.19
9.1.13
9.2.6
DRUPAL-CORE-2021-009
Incorrect Authorization in Drupal core
 Medium
EPSS 0.80%
>= 9.2.0, < 9.2.6
9.2.6
DRUPAL-CORE-2021-009
Incorrect Authorization in Drupal core
 Medium
EPSS 0.80%
>= 9.1.0, < 9.1.13
9.1.13
DRUPAL-CORE-2021-009
Incorrect Authorization in Drupal core
 Medium
EPSS 0.80%
>= 8.0.0, < 8.9.19
8.9.19
DRUPAL-CORE-2021-008
Unrestricted Upload of File with Dangerous Type in Drupal core
 Critical
EPSS 1.39%
>= 9.1.0, < 9.1.13
9.1.13
DRUPAL-CORE-2021-008
Unrestricted Upload of File with Dangerous Type in Drupal core
 Critical
EPSS 1.39%
>= 9.2.0, < 9.2.6
9.2.6
DRUPAL-CORE-2021-008
Unrestricted Upload of File with Dangerous Type in Drupal core
 Critical
EPSS 1.39%
>= 8.0.0, < 8.9.19
>= 9.1.0, < 9.1.13
>= 9.2.0, < 9.2.6
8.9.19
9.1.13
9.2.6
DRUPAL-CORE-2021-008
Unrestricted Upload of File with Dangerous Type in Drupal core
 Critical
EPSS 1.39%
>= 8.0.0, < 8.9.19
8.9.19
DRUPAL-CORE-2021-007
Cross-Site Request Forgery in Drupal core
 Medium
EPSS 0.46%
>= 9.2.0, < 9.2.6
9.2.6
DRUPAL-CORE-2021-007
Cross-Site Request Forgery in Drupal core
 Medium
EPSS 0.46%
>= 8.0.0, < 8.9.19
>= 9.1.0, < 9.1.13
>= 9.2.0, < 9.2.6
8.9.19
9.1.13
9.2.6
DRUPAL-CORE-2021-007
Cross-Site Request Forgery in Drupal core
 Medium
EPSS 0.46%
>= 8.0.0, < 8.9.19
8.9.19
DRUPAL-CORE-2021-007
Cross-Site Request Forgery in Drupal core
 Medium
EPSS 0.46%
>= 9.1.0, < 9.1.13
9.1.13
DRUPAL-CORE-2021-006
This advisory addresses a similar issue to [Drupal core - Moderately critical - Cross Site Request Forgery -…
 Not rated yet
EPSS 0.26%
>= 8.0.0, < 8.9.19
>= 9.1.0, < 9.1.13
>= 9.2.0, < 9.2.6
8.9.19
9.1.13
9.2.6
DRUPAL-CORE-2021-005
The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4), library for WYSIWYG editing.
 Not rated yet
>= 8.0.0, < 8.9.18
>= 9.1.0, < 9.1.12
>= 9.2.0, < 9.2.4
8.9.18
9.1.12
9.2.4
DRUPAL-CORE-2021-004
Directory Traversal in Archive_Tar
 High
EPSS 73.38%
>= 8.0.0, < 8.9.17
>= 9.1.0, < 9.1.11
>= 9.2.0, < 9.2.2
8.9.17
9.1.11
9.2.2
GHSA-rgx6-rjj4-c388
ckeditor4 vulnerable to cross-site scripting
 Medium
EPSS 3.19%
>= 7.0.0, < 7.80
7.80
GHSA-rgx6-rjj4-c388
ckeditor4 vulnerable to cross-site scripting
 Medium
EPSS 3.19%
>= 9.1.0, < 9.1.9
9.1.9
GHSA-rgx6-rjj4-c388
ckeditor4 vulnerable to cross-site scripting
 Medium
EPSS 3.19%
>= 9.0.0, < 9.0.14
9.0.14
GHSA-rgx6-rjj4-c388
ckeditor4 vulnerable to cross-site scripting
 Medium
EPSS 3.19%
>= 8.0.0, < 8.9.16
>= 9.0.0, < 9.0.14
>= 9.1.0, < 9.1.9
8.9.16
9.0.14
9.1.9
GHSA-rgx6-rjj4-c388
ckeditor4 vulnerable to cross-site scripting
 Medium
EPSS 3.19%
>= 8.0.0, < 8.9.16
8.9.16
DRUPAL-CORE-2021-002
Drupal core Cross-site Scripting (XSS) vulnerability
 Medium
EPSS 0.68%
>= 7.0.0, < 7.80
7.80
DRUPAL-CORE-2021-002
Drupal core Cross-site Scripting (XSS) vulnerability
 Medium
EPSS 0.68%
>= 8.0.0, < 8.9.14
>= 9.0.0, < 9.0.12
>= 9.1.0, < 9.1.7
8.9.14
9.0.12
9.1.7
DRUPAL-CORE-2021-002
Drupal core Cross-site Scripting (XSS) vulnerability
 Medium
EPSS 0.68%
>= 9.1.0, < 9.1.7
9.1.7
DRUPAL-CORE-2021-002
Drupal core Cross-site Scripting (XSS) vulnerability
 Medium
EPSS 0.68%
>= 9.0.0, < 9.0.12
9.0.12
DRUPAL-CORE-2021-002
Drupal core Cross-site Scripting (XSS) vulnerability
 Medium
EPSS 0.68%
>= 8.0.0, < 8.9.14
8.9.14
DRUPAL-CORE-2021-001
The Drupal project uses the pear Archive\_Tar library, which has released a security update that impacts Drupal.
 Not rated yet
>= 8.0.0, < 8.9.13
>= 9.0.0, < 9.0.11
>= 9.1.0, < 9.1.3
8.9.13
9.0.11
9.1.3
CVE-2020-28949
Multiple vulnerabilities through filename manipulation in Archive_Tar
Known exploited		 High
EPSS 84.55%
>= 8.0.0, < 8.8.12
>= 8.9.0, < 8.9.10
>= 9.0.0, < 9.0.9
8.8.12
8.9.10
9.0.9
CVE-2020-13671
Drupal core Unrestricted Upload of File with Dangerous Type
Known exploited		 High
EPSS 36.17%
>= 7.0.0, < 7.74
7.74
CVE-2020-13671
Drupal core Unrestricted Upload of File with Dangerous Type
Known exploited		 High
EPSS 36.17%
>= 8.0.0, < 8.8.11
8.8.11
CVE-2020-13671
Drupal core Unrestricted Upload of File with Dangerous Type
Known exploited		 High
EPSS 36.17%
>= 8.9.0, < 8.9.9
8.9.9
CVE-2020-13671
Drupal core Unrestricted Upload of File with Dangerous Type
Known exploited		 High
EPSS 36.17%
>= 9.0.0, < 9.0.8
9.0.8
CVE-2020-13671
Drupal core Unrestricted Upload of File with Dangerous Type
Known exploited		 High
EPSS 36.17%
>= 7.0.0, < 7.74
7.74
CVE-2020-13671
Drupal core Unrestricted Upload of File with Dangerous Type
Known exploited		 High
EPSS 36.17%
>= 8.0.0, < 8.8.11
8.8.11
CVE-2020-13671
Drupal core Unrestricted Upload of File with Dangerous Type
Known exploited		 High
EPSS 36.17%
>= 8.9.0, < 8.9.9
8.9.9
CVE-2020-13671
Drupal core Unrestricted Upload of File with Dangerous Type
Known exploited		 High
EPSS 36.17%
>= 9.0.0, < 9.0.8
9.0.8
CVE-2020-13671
Drupal core Unrestricted Upload of File with Dangerous Type
Known exploited		 High
EPSS 36.17%
>= 8.0.0, < 8.8.11
>= 8.9.0, < 8.9.9
>= 9.0.0, < 9.0.8
8.8.11
8.9.9
9.0.8
DRUPAL-CORE-2020-011
Exposure of Resource to Wrong Sphere in Drupal Core
 High
EPSS 1.11%
>= 8.0.0, < 8.8.10
8.8.10
DRUPAL-CORE-2020-011
Exposure of Resource to Wrong Sphere in Drupal Core
 High
EPSS 1.11%
>= 8.9.0, < 8.9.6
8.9.6
DRUPAL-CORE-2020-011
Exposure of Resource to Wrong Sphere in Drupal Core
 High
EPSS 1.11%
>= 9.0.0, < 9.0.6
9.0.6
DRUPAL-CORE-2020-011
Exposure of Resource to Wrong Sphere in Drupal Core
 High
EPSS 1.11%
>= 8.0.0, < 8.8.10
>= 8.9.0, < 8.9.6
>= 9.0.0, < 9.0.6
8.8.10
8.9.6
9.0.6
DRUPAL-CORE-2020-008
Drupal Core Access bypass vulnerability
 Medium
EPSS 0.93%
>= 8.8.0, < 8.8.10
8.8.10
DRUPAL-CORE-2020-008
Drupal Core Access bypass vulnerability
 Medium
EPSS 0.93%
>= 8.9.0, < 8.9.6
8.9.6
DRUPAL-CORE-2020-008
Drupal Core Access bypass vulnerability
 Medium
EPSS 0.93%
>= 9.0.0, < 9.0.6
9.0.6
DRUPAL-CORE-2020-008
Drupal Core Access bypass vulnerability
 Medium
EPSS 0.93%
>= 8.0.0, < 8.8.10
>= 8.9.0, < 8.9.6
>= 9.0.0, < 9.0.6
8.8.10
8.9.6
9.0.6
DRUPAL-CORE-2020-010
Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor
 Medium
EPSS 0.74%
>= 8.9.0, < 8.9.6
8.9.6
DRUPAL-CORE-2020-010
Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor
 Medium
EPSS 0.74%
>= 8.0.0, < 8.8.10
8.8.10
DRUPAL-CORE-2020-010
Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor
 Medium
EPSS 0.74%
>= 8.0.0, < 8.8.10
>= 8.9.0, < 8.9.6
>= 9.0.0, < 9.0.6
8.8.10
8.9.6
9.0.6
DRUPAL-CORE-2020-010
Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor
 Medium
EPSS 0.74%
>= 9.0.0, < 9.0.6
9.0.6
DRUPAL-CORE-2020-009
Drupal Core Cross-site scripting vulnerability
 Medium
EPSS 0.66%
>= 8.0.0, < 8.8.10
>= 8.9.0, < 8.9.6
>= 9.0.0, < 9.0.6
8.8.10
8.9.6
9.0.6
DRUPAL-CORE-2020-009
Drupal Core Cross-site scripting vulnerability
 Medium
EPSS 0.66%
>= 8.9.0, < 8.9.6
8.9.6
DRUPAL-CORE-2020-009
Drupal Core Cross-site scripting vulnerability
 Medium
EPSS 0.66%
>= 9.0.0, < 9.0.6
9.0.6
DRUPAL-CORE-2020-009
Drupal Core Cross-site scripting vulnerability
 Medium
EPSS 0.66%
>= 8.8.0, < 8.8.10
8.8.10
DRUPAL-CORE-2020-007
Drupal Core Cross-site scripting vulnerability
 Medium
EPSS 2.93%
>= 8.0.0, < 8.8.10
>= 8.9.0, < 8.9.6
>= 9.0.0, < 9.0.6
8.8.10
8.9.6
9.0.6
DRUPAL-CORE-2020-007
Drupal Core Cross-site scripting vulnerability
 Medium
EPSS 2.93%
>= 7.0.0, < 7.73
7.73
DRUPAL-CORE-2020-007
Drupal Core Cross-site scripting vulnerability
 Medium
EPSS 2.93%
>= 9.0.0, < 9.0.6
9.0.6
DRUPAL-CORE-2020-007
Drupal Core Cross-site scripting vulnerability
 Medium
EPSS 2.93%
>= 8.9.0, < 8.9.6
8.9.6
DRUPAL-CORE-2020-007
Drupal Core Cross-site scripting vulnerability
 Medium
EPSS 2.93%
>= 8.8.0, < 8.8.10
8.8.10
DRUPAL-CORE-2020-006
Drupal Core Access bypass vulnerability
 Critical
EPSS 1.27%
>= 9.0.0, < 9.0.1
9.0.1
DRUPAL-CORE-2020-006
Drupal Core Access bypass vulnerability
 Critical
EPSS 1.27%
>= 8.8.0, < 8.8.8
8.8.8
DRUPAL-CORE-2020-006
Drupal Core Access bypass vulnerability
 Critical
EPSS 1.27%
>= 8.9.0, < 8.9.1
8.9.1
DRUPAL-CORE-2020-006
Drupal Core Access bypass vulnerability
 Critical
EPSS 1.27%
>= 8.0.0, < 8.8.8
>= 8.9.0, < 8.9.1
>= 9.0.0, < 9.0.1
8.8.8
8.9.1
9.0.1
DRUPAL-CORE-2020-005
Drupal Core Arbitrary PHP code execution vulnerability
 High
EPSS 2.98%
>= 8.8.0, < 8.8.8
8.8.8
DRUPAL-CORE-2020-005
Drupal Core Arbitrary PHP code execution vulnerability
 High
EPSS 2.98%
>= 8.9.0, < 8.9.1
8.9.1
DRUPAL-CORE-2020-005
Drupal Core Arbitrary PHP code execution vulnerability
 High
EPSS 2.98%
>= 8.0.0, < 8.8.8
>= 8.9.0, < 8.9.1
>= 9.0.0, < 9.0.1
8.8.8
8.9.1
9.0.1
DRUPAL-CORE-2020-005
Drupal Core Arbitrary PHP code execution vulnerability
 High
EPSS 2.98%
>= 9.0.0, < 9.0.1
9.0.1
DRUPAL-CORE-2020-004
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability
 High
EPSS 0.69%
>= 8.0.0, < 8.8.8
8.8.8
DRUPAL-CORE-2020-004
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability
 High
EPSS 0.69%
>= 8.9.0, < 8.9.1
8.9.1
DRUPAL-CORE-2020-004
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability
 High
EPSS 0.69%
>= 9.0.0, < 9.0.1
9.0.1
DRUPAL-CORE-2020-004
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability
 High
EPSS 0.69%
>= 7.0.0, < 7.72
7.72
DRUPAL-CORE-2020-004
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability
 High
EPSS 0.69%
>= 8.0.0, < 8.8.8
>= 8.9.0, < 8.9.1
>= 9.0.0, < 9.0.1
8.8.8
8.9.1
9.0.1
DRUPAL-CORE-2020-002
The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions.
 Not rated yet
>= 8.0.0, < 8.7.14
>= 8.8.0, < 8.8.6
8.7.14
8.8.6
DRUPAL-CORE-2020-001
The Drupal project uses the third-party library [CKEditor](https://github.com/ckeditor/ckeditor4), which has released a [security…
 Not rated yet
>= 8.0.0, < 8.7.12
>= 8.8.0, < 8.8.4
8.7.12
8.8.4
DRUPAL-CORE-2019-012
The Drupal project uses the third-party library [Archive\_Tar](https://pear.php.net/package/Archive_Tar/), which has released a security improvement that is…
 Not rated yet
>= 8.0.0, < 8.7.11
>= 8.8.0, < 8.8.1
8.7.11
8.8.1
DRUPAL-CORE-2019-011
The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations.
 Not rated yet
>= 8.0.0, < 8.7.11
>= 8.8.0, < 8.8.1
8.7.11
8.8.1
DRUPAL-CORE-2019-010
Drupal 8 core's `file_save_upload()` function does not strip the leading and trailing dot ('.') from filenames, like Drupal 7 did.
 Not rated yet
>= 8.0.0, < 8.7.11
>= 8.8.0, < 8.8.1
8.7.11
8.8.1
DRUPAL-CORE-2019-009
A visit to `install.php` can cause cached data to become corrupted.
 Not rated yet
>= 8.0.0, < 8.7.11
>= 8.8.0, < 8.8.1
8.7.11
8.8.1
GHSA-g996-q5r8-w7g2
Symfony Cross-site Scripting (XSS) vulnerability
 Medium
EPSS 1.03%
>= 8.6.0, < 8.6.15
8.6.15
GHSA-g996-q5r8-w7g2
Symfony Cross-site Scripting (XSS) vulnerability
 Medium
EPSS 1.03%
>= 8.0.0, < 8.5.15
8.5.15
GHSA-v3f6-f29f-rgvp
Missing Authorization in Drupal
 Medium
EPSS 2.02%
>= 8.0, < 8.3.7
8.3.7
DRUPAL-CORE-2019-008
Drupal Improper Access Control
 Critical
EPSS 2.20%
>= 8.7.4, < 8.7.5
8.7.5
DRUPAL-CORE-2019-008
Drupal Improper Access Control
 Critical
EPSS 2.20%
>= 8.7.4, < 8.7.5
8.7.5
DRUPAL-CORE-2019-007
Directory Traversal in typo3/phar-stream-wrapper
 Critical
EPSS 5.44%
>= 8.0.0, < 8.6.16
8.6.16
DRUPAL-CORE-2019-007
Directory Traversal in typo3/phar-stream-wrapper
 Critical
EPSS 5.44%
>= 7.0.0, < 7.67.0
7.67.0
DRUPAL-CORE-2019-007
Directory Traversal in typo3/phar-stream-wrapper
 Critical
EPSS 5.44%
>= 8.0.0, < 8.6.16
>= 8.7.0, < 8.7.1
8.6.16
8.7.1
DRUPAL-CORE-2019-007
Directory Traversal in typo3/phar-stream-wrapper
 Critical
EPSS 5.44%
>= 8.7.0, < 8.7.1
8.7.1
DRUPAL-CORE-2019-006
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
 Medium
EPSS 86.82%
>= 8.0.0, < 8.5.15
>= 8.6.0, < 8.6.15
8.5.15
8.6.15
DRUPAL-CORE-2019-005
This security release fixes third-party dependencies included in or required by Drupal core.
 Not rated yet
>= 8.0.0, < 8.5.15
>= 8.6.0, < 8.6.15
8.5.15
8.6.15
DRUPAL-CORE-2019-004
Drupal Cross Site Scripting (XSS) vulnerability
 Medium
EPSS 12.19%
>= 8.0.0, < 8.5.14
8.5.14
DRUPAL-CORE-2019-004
Drupal Cross Site Scripting (XSS) vulnerability
 Medium
EPSS 12.19%
>= 7.0.0, < 7.65.0
7.65.0
DRUPAL-CORE-2019-004
Drupal Cross Site Scripting (XSS) vulnerability
 Medium
EPSS 12.19%
>= 8.0.0, < 8.5.14
>= 8.6.0, < 8.6.13
8.5.14
8.6.13
DRUPAL-CORE-2019-004
Drupal Cross Site Scripting (XSS) vulnerability
 Medium
EPSS 12.19%
>= 8.6.0, < 8.6.13
8.6.13
CVE-2019-6340
Drupal Core Remote Code Execution Vulnerability
Known exploited		 High
EPSS 92.02%
>= 8.6.0, < 8.6.10
8.6.10
CVE-2019-6340
Drupal Core Remote Code Execution Vulnerability
Known exploited		 High
EPSS 92.02%
>= 8.0.0, < 8.5.11
8.5.11
CVE-2019-6340
Drupal Core Remote Code Execution Vulnerability
Known exploited		 High
EPSS 92.02%
>= 7.0.0, < 7.62.0
7.62.0
CVE-2019-6340
Drupal Core Remote Code Execution Vulnerability
Known exploited		 High
EPSS 92.02%
>= 8.6.0, < 8.6.10
8.6.10
CVE-2019-6340
Drupal Core Remote Code Execution Vulnerability
Known exploited		 High
EPSS 92.02%
>= 8.0.0, < 8.5.11
>= 8.6.0, < 8.6.10
8.5.11
8.6.10
CVE-2019-6340
Drupal Core Remote Code Execution Vulnerability
Known exploited		 High
EPSS 92.02%
>= 8.0.0, < 8.5.11
8.5.11
CVE-2019-6340
Drupal Core Remote Code Execution Vulnerability
Known exploited		 High
EPSS 92.02%
>= 7.0.0, < 7.62.0
7.62.0
DRUPAL-CORE-2019-002
Arbitrary PHP code execution in Drupal
 Critical
EPSS 35.95%
>= 8.0.0, < 8.5.9
>= 8.6.0, < 8.6.6
8.5.9
8.6.6
DRUPAL-CORE-2019-002
Arbitrary PHP code execution in Drupal
 Critical
EPSS 35.95%
>= 8.0.0, < 8.5.9
8.5.9
DRUPAL-CORE-2019-002
Arbitrary PHP code execution in Drupal
 Critical
EPSS 35.95%
>= 8.6.0, < 8.6.6
8.6.6
DRUPAL-CORE-2019-002
Arbitrary PHP code execution in Drupal
 Critical
EPSS 35.95%
>= 7.0.0, < 7.62.0
7.62.0
DRUPAL-CORE-2019-001
Drupal core third-party PEAR Archive_Tar library is vulnerable to Deserialization of Untrusted Data
 High
EPSS 2.12%
>= 8.0.0, < 8.5.9
>= 8.6.0, < 8.6.6
8.5.9
8.6.6
CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.17%
>= 8.0, < 8.4.8
8.4.8
CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.17%
>= 8.5, < 8.5.3
8.5.3
CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.17%
>= 8.0, < 8.4.8
8.4.8
CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.17%
>= 8.0.0, < 8.4.8
>= 8.5.0, < 8.5.3
8.4.8
8.5.3
CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.17%
>= 7.0, < 7.59
7.59
CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.17%
>= 8.5, < 8.5.3
8.5.3
CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.17%
>= 7.0, < 7.59
7.59
DRUPAL-CORE-2018-003
Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)
 Medium
EPSS 1.72%
>= 8.5.0, < 8.5.2
8.5.2
DRUPAL-CORE-2018-003
Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)
 Medium
EPSS 1.72%
>= 8.0, < 8.4.7
8.4.7
DRUPAL-CORE-2018-003
Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)
 Medium
EPSS 1.72%
>= 8.0.0, < 8.4.7
>= 8.5.0, < 8.5.2
8.4.7
8.5.2
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.99%
>= 7.0, < 7.58
7.58
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.99%
>= 8.0.0, < 8.3.9
>= 8.4.0, < 8.4.6
>= 8.5.0, < 8.5.1
8.3.9
8.4.6
8.5.1
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.99%
>= 8.5.0, < 8.5.1
8.5.1
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.99%
>= 8.4.0, < 8.4.6
8.4.6
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.99%
>= 8.0, < 8.3.9
8.3.9
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.99%
>= 7.0, < 7.58
7.58
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.99%
>= 8.5.0, < 8.5.1
8.5.1
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.99%
>= 8.4.0, < 8.4.6
8.4.6
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Known exploited		 Critical
EPSS 99.99%
>= 8.0, < 8.3.9
8.3.9
DRUPAL-CORE-2018-001
This security advisory fixes multiple vulnerabilities in both Drupal 7 and Drupal 8.
 Not rated yet
>= 8.0.0, < 8.4.5
8.4.5
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor