drupal/core
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Packagist
- Vulnerability status
- 198 advisory(ies) without a verdict
Advisories (201)
| Advisory | Affected versions | Latest version |
|---|---|---|
| DRUPAL-CORE-2018-001 This security advisory fixes multiple vulnerabilities in both Drupal 7 and Drupal 8. See below for a list. | 8.0.0 – < 8.4.5 | Undetermined |
| DRUPAL-CORE-2018-002 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vect | 8.0.0 – < 8.3.9 ; 8.4.0 – < 8.4.6 ; 8.5.0 – < 8.5.1 | Undetermined |
| DRUPAL-CORE-2018-003 CKEditor, a third-party JavaScript library included in Drupal core, has [fixed a cross-site scripting (XSS) vulnerability](https://ckeditor.com/blog/CKEditor-4. | 8.0.0 – < 8.4.7 ; 8.5.0 – < 8.5.2 | Undetermined |
| DRUPAL-CORE-2018-004 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vect | 8.0.0 – < 8.4.8 ; 8.5.0 – < 8.5.3 | Undetermined |
| DRUPAL-CORE-2019-001 Drupal core uses the third-party PEAR Archive\_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to [CVE- | 8.0.0 – < 8.5.9 ; 8.6.0 – < 8.6.6 | Undetermined |
| DRUPAL-CORE-2019-002 A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. | 8.0.0 – < 8.5.9 ; 8.6.0 – < 8.6.6 | Undetermined |
| DRUPAL-CORE-2019-003 Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. | 8.0.0 – < 8.5.11 ; 8.6.0 – < 8.6.10 | Undetermined |
| DRUPAL-CORE-2019-004 Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability. | 8.0.0 – < 8.5.14 ; 8.6.0 – < 8.6.13 | Undetermined |
| DRUPAL-CORE-2019-005 This security release fixes third-party dependencies included in or required by Drupal core. | 8.0.0 – < 8.5.15 ; 8.6.0 – < 8.6.15 | Undetermined |
| DRUPAL-CORE-2019-006 The jQuery project released version 3.4.0, and as part of that, disclosed a security vulnerability that affects all prior versions. As described in their [relea | 8.0.0 – < 8.5.15 ; 8.6.0 – < 8.6.15 | Undetermined |
| DRUPAL-CORE-2019-007 This security release fixes third-party dependencies included in or required by Drupal core. As described in [TYPO3-PSA-2019-007: By-passing protection of Phar | 8.0.0 – < 8.6.16 ; 8.7.0 – < 8.7.1 | Undetermined |
| DRUPAL-CORE-2019-008 In Drupal 8.7.4, when the [experimental](https://www.drupal.org/core/experimental#beta) Workspaces module is enabled, an access bypass condition is created. | 8.7.4 – < 8.7.5 | Undetermined |
| DRUPAL-CORE-2019-009 A visit to `install.php` can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt. | 8.0.0 – < 8.7.11 ; 8.8.0 – < 8.8.1 | Undetermined |
| DRUPAL-CORE-2019-010 Drupal 8 core's `file_save_upload()` function does not strip the leading and trailing dot ('.') from filenames, like Drupal 7 did. | 8.0.0 – < 8.7.11 ; 8.8.0 – < 8.8.1 | Undetermined |
| DRUPAL-CORE-2019-011 The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations. | 8.0.0 – < 8.7.11 ; 8.8.0 – < 8.8.1 | Undetermined |
| DRUPAL-CORE-2019-012 The Drupal project uses the third-party library [Archive\_Tar](https://pear.php.net/package/Archive_Tar/), which has released a security improvement that is nee | 8.0.0 – < 8.7.11 ; 8.8.0 – < 8.8.1 | Undetermined |
| DRUPAL-CORE-2020-001 The Drupal project uses the third-party library [CKEditor](https://github.com/ckeditor/ckeditor4), which has released a [security improvement](https://ckeditor. | 8.0.0 – < 8.7.12 ; 8.8.0 – < 8.8.4 | Undetermined |
| DRUPAL-CORE-2020-002 The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the [jQue | 8.0.0 – < 8.7.14 ; 8.8.0 – < 8.8.6 | Undetermined |
| DRUPAL-CORE-2020-004 The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities. | 8.0.0 – < 8.8.8 ; 8.9.0 – < 8.9.1 ; 9.0.0 – < 9.0.1 | Undetermined |
| DRUPAL-CORE-2020-005 Drupal 8 and 9 have a remote code execution vulnerability under certain circumstances. | 8.0.0 – < 8.8.8 ; 8.9.0 – < 8.9.1 ; 9.0.0 – < 9.0.1 | Undetermined |
| DRUPAL-CORE-2020-006 JSON:API PATCH requests may bypass validation for certain fields. | 8.0.0 – < 8.8.8 ; 8.9.0 – < 8.9.1 ; 9.0.0 – < 9.0.1 | Undetermined |
| DRUPAL-CORE-2020-007 The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting. | 8.0.0 – < 8.8.10 ; 8.9.0 – < 8.9.6 ; 9.0.0 – < 9.0.6 | Undetermined |
| DRUPAL-CORE-2020-008 The experimental Workspaces module allows you to create multiple workspaces on your site in which draft content can be edited before being published to the live | 8.0.0 – < 8.8.10 ; 8.9.0 – < 8.9.6 ; 9.0.0 – < 9.0.6 | Undetermined |
| DRUPAL-CORE-2020-009 Drupal 8 and 9 have a reflected cross-site scripting (XSS) vulnerability under certain circumstances. | 8.0.0 – < 8.8.10 ; 8.9.0 – < 8.9.6 ; 9.0.0 – < 9.0.6 | Undetermined |
| DRUPAL-CORE-2020-010 Drupal core's built-in CKEditor image caption functionality is vulnerable to XSS. | 8.0.0 – < 8.8.10 ; 8.9.0 – < 8.9.6 ; 9.0.0 – < 9.0.6 | Undetermined |
| DRUPAL-CORE-2020-011 A vulnerability exists in the File module which allows an attacker to gain access to the file metadata of a permanent private file that they do not have access | 8.0.0 – < 8.8.10 ; 8.9.0 – < 8.9.6 ; 9.0.0 – < 9.0.6 | Undetermined |
| DRUPAL-CORE-2020-012 *Update November 18: Documented longer list of dangerous file extensions* | 8.0.0 – < 8.8.11 ; 8.9.0 – < 8.9.9 ; 9.0.0 – < 9.0.8 | Undetermined |
| DRUPAL-CORE-2020-013 The Drupal project uses the PEAR Archive\_Tar library. The PEAR Archive\_Tar library has released a security update that impacts Drupal. For more information pl | 8.0.0 – < 8.8.12 ; 8.9.0 – < 8.9.10 ; 9.0.0 – < 9.0.9 | Undetermined |
| DRUPAL-CORE-2021-001 The Drupal project uses the pear Archive\_Tar library, which has released a security update that impacts Drupal. For more information please see: | 8.0.0 – < 8.9.13 ; 9.0.0 – < 9.0.11 ; 9.1.0 – < 9.1.3 | Undetermined |
| DRUPAL-CORE-2021-002 Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. | 8.0.0 – < 8.9.14 ; 9.0.0 – < 9.0.12 ; 9.1.0 – < 9.1.7 | Undetermined |
| DRUPAL-CORE-2021-003 **Update: 2021-06-11: Added CVE-2021-33829 identifier** | 8.0.0 – < 8.9.16 ; 9.0.0 – < 9.0.14 ; 9.1.0 – < 9.1.9 | Undetermined |
| DRUPAL-CORE-2021-004 The Drupal project uses the pear Archive\_Tar library, which has released a security update that impacts Drupal. | 8.0.0 – < 8.9.17 ; 9.1.0 – < 9.1.11 ; 9.2.0 – < 9.2.2 | Undetermined |
| DRUPAL-CORE-2021-005 The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4), library for WYSIWYG editing. CKEditor has released [a security update that impact | 8.0.0 – < 8.9.18 ; 9.1.0 – < 9.1.12 ; 9.2.0 – < 9.2.4 | Undetermined |
| DRUPAL-CORE-2021-006 The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged us | 8.0.0 – < 8.9.19 ; 9.1.0 – < 9.1.13 ; 9.2.0 – < 9.2.6 | Undetermined |
| DRUPAL-CORE-2021-007 The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible dat | 8.0.0 – < 8.9.19 ; 9.1.0 – < 9.1.13 ; 9.2.0 – < 9.2.6 | Undetermined |
| DRUPAL-CORE-2021-008 Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access | 8.0.0 – < 8.9.19 ; 9.1.0 – < 9.1.13 ; 9.2.0 – < 9.2.6 | Undetermined |
| DRUPAL-CORE-2021-009 The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. | 8.0.0 – < 8.9.19 ; 9.1.0 – < 9.1.13 ; 9.2.0 – < 9.2.6 | Undetermined |
| DRUPAL-CORE-2021-010 Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. | 8.0.0 – < 8.9.19 ; 9.1.0 – < 9.1.13 ; 9.2.0 – < 9.2.6 | Undetermined |
| DRUPAL-CORE-2021-011 The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4) library for WYSIWYG editing. CKEditor has released [a security update that impacts | 8.0.0 – < 8.9.20 ; 9.1.0 – < 9.1.14 ; 9.2.0 – < 9.2.9 | Undetermined |
| DRUPAL-CORE-2022-001 jQuery UI is a third-party library used by Drupal. This library was previously thought to be end-of-life. | 8.0.0 – < 9.2.11 ; 9.3.0 – < 9.3.3 | Undetermined |
| DRUPAL-CORE-2022-003 Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow a | 8.0.0 – < 9.2.13 ; 9.3.0 – < 9.3.6 | Undetermined |
| DRUPAL-CORE-2022-004 The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission view | 8.0.0 – < 9.2.13 ; 9.3.0 – < 9.3.6 | Undetermined |
| DRUPAL-CORE-2022-005 The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4) library for WYSIWYG editing. CKEditor has released [a security update that impacts | 8.0.0 – < 9.2.15 ; 9.3.0 – < 9.3.8 | Undetermined |
| DRUPAL-CORE-2022-006 Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. [Guzzle has released a security update](https://github | 8.0.0 – < 9.2.16 ; 9.3.0 – < 9.3.9 | Undetermined |
| DRUPAL-CORE-2022-008 Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow a | 8.0.0 – < 9.2.18 ; 9.3.0 – < 9.3.12 | Undetermined |
| DRUPAL-CORE-2022-009 Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in | 9.3.0 – < 9.3.12 | Undetermined |
| DRUPAL-CORE-2022-010 Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. [Guzzle has released a security update](https://github | 8.0.0 – < 9.2.20 ; 9.3.0 – < 9.3.14 | Undetermined |
| DRUPAL-CORE-2022-011 *Updated 22:00 UTC 2022-06-10: Added steps to update without `drupal/core-recommended`.* | 8.0.0 – < 9.2.21 ; 9.3.0 – < 9.3.16 | Undetermined |
| DRUPAL-CORE-2022-012 In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative | 8.0.0 – < 9.3.19 ; 9.4.0 – < 9.4.3 | Undetermined |
| DRUPAL-CORE-2022-013 Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should no | 8.0.0 – < 9.3.19 ; 9.4.0 – < 9.4.3 | Undetermined |
| DRUPAL-CORE-2022-014 *Updated 2022-07-20 19:45 UTC to indicate that this only affects Apache web servers.* | 8.0.0 – < 9.3.19 ; 9.4.0 – < 9.4.3 | Undetermined |
| DRUPAL-CORE-2022-015 The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Un | 8.0.0 – < 9.3.19 ; 9.4.0 – < 9.4.3 | Undetermined |
| DRUPAL-CORE-2022-016 Drupal uses the [Twig](https://twig.symfony.com/) third-party library for content templating and sanitization. [Twig has released a security update](https://sym | 8.0.0 – < 9.3.22 ; 9.4.0 – < 9.4.7 | Undetermined |
| DRUPAL-CORE-2023-001 The Media Library module does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about | 8.0.0 – < 9.4.10 ; 9.5.0 – < 9.5.2 ; 10.0.0 – < 10.0.2 | Undetermined |
| DRUPAL-CORE-2023-002 The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access | 8.0.0 – < 9.4.12 ; 9.5.0 – < 9.5.5 ; 10.0.0 – < 10.0.5 | Undetermined |
| DRUPAL-CORE-2023-003 The language module provides a Language switcher block which can be placed to provide links to quickly switch between different languages. | 8.0.0 – < 9.4.12 ; 9.5.0 – < 9.5.5 ; 10.0.0 – < 10.0.5 | Undetermined |
| DRUPAL-CORE-2023-004 Drupal core provides a page that outputs the markup from `phpinfo()` to assist with diagnosing PHP configuration. | 8.0.0 – < 9.4.12 ; 9.5.0 – < 9.5.5 ; 10.0.0 – < 10.0.5 | Undetermined |
| DRUPAL-CORE-2023-005 The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they sh | 8.0.0 – < 9.4.14 ; 9.5.0 – < 9.5.8 ; 10.0.0 – < 10.0.8 | Undetermined |
| DRUPAL-CORE-2023-006 In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and mad | 8.7.0 – < 9.5.11 ; 10.0.0 – < 10.0.11 ; 10.1.0 – < 10.1.4 | Undetermined |
| DRUPAL-CORE-2024-001 The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DO | 8.0.0 – < 10.1.8 ; 10.2.0 – < 10.2.2 | Undetermined |
| DRUPAL-CORE-2024-002 Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on th | 10.0.0 – < 10.2.10 | Undetermined |
| DRUPAL-CORE-2024-003 Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. | 8.8.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 ; 11.0.0 – < 11.0.8 | Undetermined |
| DRUPAL-CORE-2024-004 Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. | 8.0.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 ; 11.0.0 – < 11.0.8 | Undetermined |
| DRUPAL-CORE-2024-006 Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Artbitrary File Deletion. It is not di | 8.0.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 ; 11.0.0 – < 11.0.8 | Undetermined |
| DRUPAL-CORE-2024-007 Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not direc | 8.0.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 ; 11.0.0 – < 11.0.8 | Undetermined |
| DRUPAL-CORE-2024-008 Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not direc | 8.0.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 | Undetermined |
| DRUPAL-CORE-2025-001 Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability (XSS). | 8.0.0 – < 10.3.13 ; 10.4.0 – < 10.4.3 ; 11.0.0 – < 11.0.12 ; … | Undetermined |
| DRUPAL-CORE-2025-002 Bulk operations allow authorized users to modify several nodes at once from the Content page (`/admin/content`). A site builder can also add bulk operations to | 8.0.0 – < 10.3.13 ; 10.4.0 – < 10.4.3 ; 11.0.0 – < 11.0.12 ; … | Undetermined |
| DRUPAL-CORE-2025-003 Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Arbitrary File Inclusion. Techniques e | 8.0.0 – < 10.3.13 ; 10.4.0 – < 10.4.3 ; 11.0.0 – < 11.0.12 ; … | Undetermined |
| DRUPAL-CORE-2025-004 Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability (XSS). | 8.0.0 – < 10.3.14 ; 10.4.0 – < 10.4.5 ; 11.0.0 – < 11.0.13 ; … | Undetermined |
| DRUPAL-CORE-2025-005 Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HTTP requests to be overridden. | 8.0.0 – < 10.4.9 ; 10.5.0 – < 10.5.6 ; 11.0.0 – < 11.1.9 ; … | Undetermined |
| DRUPAL-CORE-2025-006 Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" pre | 8.0.0 – < 10.4.9 ; 10.5.0 – < 10.5.6 ; 11.0.0 – < 11.1.9 ; … | Undetermined |
| DRUPAL-CORE-2025-007 By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement. | 8.0.0 – < 10.4.9 ; 10.5.0 – < 10.5.6 ; 11.0.0 – < 11.1.9 ; … | Undetermined |
| DRUPAL-CORE-2025-008 The core `system` module handles downloads of private and temporary files. Contrib modules can define additional kinds of files (schemes) that may also be handl | 8.0.0 – < 10.4.9 ; 10.5.0 – < 10.5.6 ; 11.0.0 – < 11.1.9 ; … | Undetermined |
| DRUPAL-CORE-2026-001 Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to a cross-site scripting (XSS) vuln | 8.0.0 – < 10.5.9 ; 10.6.0 – < 10.6.7 ; 11.0.0 – < 11.2.11 ; … | Undetermined |
| DRUPAL-CORE-2026-002 Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chai | 8.0.0 – < 10.5.9 ; 10.6.0 – < 10.6.7 ; 11.0.0 – < 11.2.11 ; … | Undetermined |
| DRUPAL-CORE-2026-003 Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5. | 11.3.0 – < 11.3.7 | Undetermined |
| DRUPAL-CORE-2026-004 Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. | 8.9.0 – < 10.4.10 ; 10.5.0 – < 10.5.10 ; 10.6.0 – < 10.6.9 ; … | Undetermined |
| DRUPAL-CORE-2026-005 [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) added protection for fields that store serialized data to disallow direct writes via web services. | < 10.5.12 ; 10.6.0 – < 10.6.11 ; 11.2.0 – < 11.2.14 ; … | Undetermined |
| DRUPAL-CORE-2026-006 Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chai | < 10.5.12 ; 10.6.0 – < 10.6.11 ; 11.2.0 – < 11.2.14 ; … | Undetermined |
| DRUPAL-CORE-2026-007 Drupal core ships a `rebuild.php` front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an | < 10.5.12 ; 10.6.0 – < 10.6.11 ; 11.2.0 – < 11.2.14 ; … | Undetermined |
| DRUPAL-CORE-2026-008 The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via `providers.json` and via URL discovery. | < 10.5.12 ; 10.6.0 – < 10.6.11 ; 11.2.0 – < 11.2.14 ; … | Undetermined |
| DRUPAL-CORE-2026-009 The JSON:API and REST modules allow you to upload image files to image fields. | < 10.5.12 ; 10.6.0 – < 10.6.11 ; 11.2.0 – < 11.2.14 ; … | Undetermined |
| DRUPAL-CORE-2026-010 The Image module allows you to define and configure image fields. | < 10.6.13 ; 11.3.0 – < 11.3.14 ; 11.4.0 – < 11.4.4 ; … | Undetermined |
| DRUPAL-CORE-2026-011 Drupal core 11.2 and above integrate the HTMX JavaScript library. | 11.3.0 – < 11.3.14 ; 11.4.0 – < 11.4.4 ; 11.2.0 – < 11.3.0 | Undetermined |
| DRUPAL-CORE-2026-012 The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability. | < 10.6.13 ; 11.3.0 – < 11.3.14 ; 11.4.0 – < 11.4.4 ; … | Undetermined |
| DRUPAL-CORE-2026-013 The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing. CKEditor has released [a security update that impacts | 10.5.0 – < 10.6.17 ; 11.0.0 – < 11.3.17 ; 11.4.0 – < 11.4.7 | Undetermined |
| DRUPAL-CORE-2026-014 A remote code execution vulnerability exists within the Field UI module in Drupal core. | 8.9.0 – < 10.6.19 ; 11.0.0 – < 11.3.19 ; 11.4.0 – < 11.4.10 ; … | Undetermined |
| DRUPAL-CORE-2026-015 The Drupal core Link module provides a field type that can be used for internal and external URLs. | 8.9.0 – < 10.6.19 ; 11.0.0 – < 11.3.19 ; 11.4.0 – < 11.4.10 ; … | Undetermined |
| DRUPAL-CORE-2026-016 The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. | 10.3.0 – < 10.6.19 ; 11.0.0 – < 11.3.19 ; 11.4.0 – < 11.4.10 ; … | Undetermined |
| GHSA-297x-j9pm-xjgg Drupal Core Remote Code Execution Vulnerability | 7.0 – < 7.59 ; 8.0 – < 8.4.8 ; 8.5 – < 8.5.3 | Undetermined |
| GHSA-2p28-5mvp-2j2r Drupal Comment reply form allows access to restricted content | 8.4.0 – < 8.4.5 ; 7.0 – < 7.57 | Undetermined |
| GHSA-2qph-q8xw-gv7q Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability | 8.0.0 – < 10.3.13 ; 10.4.0 – < 10.4.3 ; 11.0.0 – < 11.0.12 ; … | Undetermined |
| GHSA-3327-jr93-7hq3 Drupal access bypass vulnerability | 8.4.0 – < 8.4.5 | Undetermined |
| GHSA-39g6-x4x8-5jcm Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages | 8.0.0 – < 10.3.13 ; 10.4.0 – < 10.4.3 ; 11.0.0 – < 11.0.12 ; … | Undetermined |
| GHSA-3gx6-h57h-rm27 Drupal Core Remote Code Execution Vulnerability | 8.6.0 – < 8.6.10 ; 7.0.0 – < 7.62.0 ; 8.0.0 – < 8.5.11 | Undetermined |
| GHSA-3m36-mjwj-352c Drupal core Cross-site Scripting (XSS) vulnerability | 7.0.0 – < 7.80 ; 8.0.0 – < 8.9.14 ; 9.0.0 – < 9.0.12 ; … | Undetermined |
| GHSA-3xr3-phjp-g6p2 Drupal core access bypass vulnerability | 8.0.0 – < 8.9.19 ; 9.1.0 – < 9.1.13 ; 9.2.0 – < 9.2.6 | Undetermined |
| GHSA-4gh5-3hqj-x3pj Drupal Form API ignores access restrictions on submit buttons | 6.0 – < 6.38 | Undetermined |
| GHSA-4wfq-jc9h-vpcx Lack of domain validation in Druple core | 8.0.0 – < 9.3.19 ; 9.4.0 – < 9.4.3 | Undetermined |
| GHSA-52jr-x6h6-xj6g Drupal core vulnerable to improper error handling | 10.0.0 – < 10.2.10 | Undetermined |
| GHSA-585j-5449-mf5m Drupal cross-site scripting vulnerability | 8.4.0 – < 8.4.5 ; 7.0 – < 7.57 | Undetermined |
| GHSA-58f3-cx8p-h8jg Drupal core access bypass vulnerability | 7.0 – < 7.56 ; 8.0 – < 8.3.4 | Undetermined |
| GHSA-5vpr-v24w-mmjj Drupal cross site scripting vulnerability | 7.0 – < 7.57 ; 8.0 – < 8.4.0 | Undetermined |
| GHSA-62cf-jvpp-48q6 Drupal Denial of Service vulnerability | 9.3.6 | Not affected |
| GHSA-66gr-xrcf-8jpq Drupal Open Redirect | 7.0 – < 7.52 ; 8.0 – < 8.2.3 | Undetermined |
| GHSA-66mv-q8r2-hj8w Drupal access bypass vulnerability | 7.0 – < 7.57 | Undetermined |
| GHSA-68jc-v27h-vhmw Drupal core Unrestricted Upload of File with Dangerous Type | 9.0.0 – < 9.0.8 ; 8.9.0 – < 8.9.9 ; 8.0.0 – < 8.8.11 ; … | Undetermined |
| GHSA-6955-67hm-vjjq Drupal core arbitrary PHP code execution | 8.0.0 – < 9.3.19 ; 9.4.0 – < 9.4.3 | Undetermined |
| GHSA-69g8-g9jq-74v7 Drupal arbitrary code execution | 6.0 – < 6.38 | Undetermined |
| GHSA-6ccv-8fgf-cjpw Drupal core Denial of Service vulnerability | 8.0.0 – < 10.1.8 ; 10.2.0 – < 10.2.2 | Undetermined |
| GHSA-6g9h-6v79-w4pc Drupal Users without "Administer comments" can set comment visibility on nodes they can edit | 8.0.0 – < 8.1.10 | Undetermined |
| GHSA-6gf6-24h2-66j4 Drupal core Open Redirect vulnerability | 7.0.0 – < 7.70 | Undetermined |
| GHSA-6hpj-9xj7-2jxx Drupal access control bypass vulnerability | 8.0 – < 8.2.8 ; 8.3.0 – < 8.3.1 | Undetermined |
| GHSA-6mgp-v5cm-ghg5 Drupal core Remote Code Execution | 7.0 – < 7.60 ; 8.0.0 – < 8.5.8 ; 8.6.0 – < 8.6.2 | Undetermined |
| GHSA-73q4-j324-2qcc Incorrect authorization in Drupal core | 9.3.0 – < 9.3.6 ; 8.0.0 – < 9.2.13 | Undetermined |
| GHSA-7cwc-fjqm-8vh8 Drupal core Access bypass | 8.0.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 ; 11.0.0 – < 11.0.8 | Undetermined |
| GHSA-7f4f-p7mq-p4fv Drupal External URL injection through URL aliases leading to Open Redirect | 7.0 – < 7.60 ; 8.0.0 – < 8.5.8 ; 8.6.0 – < 8.6.2 | Undetermined |
| GHSA-7ffh-cjvg-fpr4 Drupal Settings Tray access bypass | 8.4.0 – < 8.4.5 | Undetermined |
| GHSA-7fh9-933g-885p Drupal Core Remote Code Execution Vulnerability | 7.0 – < 7.58 ; 8.0 – < 8.3.9 ; 8.4.0 – < 8.4.6 ; … | Undetermined |
| GHSA-7gwj-7fhm-vw4w Drupal core unrestricted file upload | 8.0.0 – < 8.7.11 ; 8.8.0 – < 8.8.1 | Undetermined |
| GHSA-7jr4-hgqx-vwgq Access bypass in Drupal core | 9.3.0 – < 9.3.12 | Undetermined |
| GHSA-7v68-3pr5-h3cr Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution | 8.0.0 – < 8.5.8 ; 8.6.0 – < 8.6.2 | Undetermined |
| GHSA-836p-6p4j-35cg Drupal Open Redirect | 8.0 – < 8.0.4 ; 7.0 – < 7.43 ; 6.0 – < 6.38 | Undetermined |
| GHSA-83v7-c2cf-p9c2 Drupal core allows Forceful Browsing | 8.0.0 – < 10.4.9 ; 10.5.0 – < 10.5.6 ; 11.0.0 – < 11.1.9 ; … | Undetermined |
| GHSA-8849-cv9f-vccm Access bypass in Drupal core | 10.0.0 – < 10.0.8 ; 9.5.0 – < 9.5.8 ; 9.0.0 – < 9.4.14 ; … | Undetermined |
| GHSA-8cw5-rv98-5c46 Arbitrary PHP code execution in Drupal | 7.0.0 – < 7.62.0 ; 8.0.0 – < 8.5.9 ; 8.6.0 – < 8.6.6 | Undetermined |
| GHSA-8jj2-x2gc-ggm7 Drupal Core Cross-site scripting vulnerability | 8.8.0 – < 8.8.10 ; 8.9.0 – < 8.9.6 ; 9.0.0 – < 9.0.6 ; … | Undetermined |
| GHSA-8mvq-8h2v-j9vf Drupal Core Cross-Site Scripting (XSS) | 8.8.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 ; 11.0.0 – < 11.0.8 | Undetermined |
| GHSA-938f-5r4f-h65v Drupal core contains a potential PHP Object Injection vulnerability | 8.8.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 ; 11.0.0 – < 11.0.8 | Undetermined |
| GHSA-96vx-qf28-6f8m Drupal Access Control Bypass | 7.0 – < 7.3 | Undetermined |
| GHSA-98h9-727m-44qv Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar | 7.0.0 – < 7.69 ; 8.0.0 – < 8.7.11 ; 8.8.0 – < 8.8.1 | Undetermined |
| GHSA-98w5-wqp9-w466 Drupal Incorrect cache context on password reset page | 8.0 – < 8.2.3 | Undetermined |
| GHSA-9c24-g32g-35rj Drupal PECL YAML parser unsafe object handling | 8.0 – < 8.3.4 | Undetermined |
| GHSA-c533-c843-67h8 Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor | 8.0.0 – < 8.8.10 ; 8.9.0 – < 8.9.6 ; 9.0.0 – < 9.0.6 | Undetermined |
| GHSA-cfh2-7f6h-3m85 Access bypass in Drupal Core | 8.0.0 – < 9.3.19 ; 9.4.0 – < 9.4.3 | Undetermined |
| GHSA-cmmh-8mwp-gq5p Drupal Cross Site Scripting (XSS) vulnerability | 7.0.0 – < 7.65.0 ; 8.0.0 – < 8.5.14 ; 8.6.0 – < 8.6.13 | Undetermined |
| GHSA-f3cj-mjqm-fhvj Drupal core is Vulnerable to Cross-Site Scripting | 8.0.0 – < 10.5.9 ; 10.6.0 – < 10.6.7 ; 11.0.0 – < 11.2.11 ; … | Undetermined |
| GHSA-f4qx-jqfq-7785 Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions | 8.0 – < 8.3.7 | Undetermined |
| GHSA-f84q-mgj9-8jfc Drupal Content moderation Access bypass | 8.0.0 – < 8.5.8 ; 8.6.0 – < 8.6.2 | Undetermined |
| GHSA-fg5q-r2q5-qmh3 Drupal CRLF injection vulnerability in the drupal_set_header function | 6.0 – < 6.38 | Undetermined |
| GHSA-fmfv-x8mp-5767 Improper input validation in Drupal core | 9.3.0 – < 9.3.6 ; 8.0.0 – < 9.2.13 ; 7.0.0 – < 7.88 | Undetermined |
| GHSA-fmqh-2j2x-vgp3 Drupal Unprivileged access to config export | 8.0 – < 8.1.10 | Undetermined |
| GHSA-frqf-9qr4-6vxf Drupal Saving user accounts can sometimes grant the user all roles | 7.0 – < 7.44 | Undetermined |
| GHSA-g36h-4jr6-qmm9 Improper input validation in Drupal core | 8.0.0 – < 9.2.18 ; 9.3.0 – < 9.3.12 | Undetermined |
| GHSA-g78h-pf65-46rv Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS) | 8.5.0 – < 8.5.2 ; 8.0 – < 8.4.7 | Undetermined |
| GHSA-g996-q5r8-w7g2 Symfony Cross-site Scripting (XSS) vulnerability | 8.0.0 – < 8.5.15 ; 8.6.0 – < 8.6.15 | Undetermined |
| GHSA-gfvf-2f25-f34r Drupal Anonymous Open Redirect | 8.0.0 – < 8.5.8 ; 8.6.0 – < 8.6.2 | Undetermined |
| GHSA-ghwc-95x2-682j Drupal Core has a SQL Injection issue | 8.9.0 – < 10.4.10 ; 10.5.0 – < 10.5.10 ; 10.6.0 – < 10.6.9 ; … | Undetermined |
| GHSA-gjqg-9rhv-qj67 Drupal Core Open Redirect vulnerability | 7.0.0 – < 7.70 | Undetermined |
| GHSA-gvf2-2f4g-jqf4 Drupal core contains a potential PHP Object Injection vulnerability | 8.8.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 ; 7.0 – < 7.102 | Undetermined |
| GHSA-gxwx-c7m8-f95h Drupal Open redirect vulnerability in the drupal_goto function | 6.0 – < 6.38 | Undetermined |
| GHSA-gxxj-g9v8-w28p Drupal core Arbitrary PHP code execution | 7.0.0 – < 7.75 ; 8.0.0 – < 8.8.12 ; 8.9.0 – < 8.9.10 ; … | Undetermined |
| GHSA-gxxq-fhc7-3jv9 Drupal Cross-Site Request Forgery (CSRF) | 8.2.0 – < 8.2.7 | Undetermined |
| GHSA-h377-287m-w2r9 Drupal file REST resource does not properly validate | 8.0 – < 8.3.4 | Undetermined |
| GHSA-h3r9-pjmr-f938 Drupal Brute force amplification attacks via XML-RPC | 7.0 – < 7.43 ; 6.0 – < 6.38 | Undetermined |
| GHSA-h89p-5896-f4q8 Drupal core allows Content Spoofing | 8.0.0 – < 10.4.9 ; 10.5.0 – < 10.5.6 ; 11.0.0 – < 11.1.9 ; … | Undetermined |
| GHSA-hcq9-hmgf-6qr9 Drupal SQL Injection vulnerability | 6.20 | Not affected |
| GHSA-j586-cj67-vg4p Cross-Site Request Forgery in Drupal core | 8.0.0 – < 8.9.19 ; 9.1.0 – < 9.1.13 ; 9.2.0 – < 9.2.6 | Undetermined |
| GHSA-jpj8-49hr-wcwv Drupal Denial of service via transliterate mechanism | 8.0 – < 8.2.3 | Undetermined |
| GHSA-m4wj-hhwj-47qp Drupal Core Cross-Site Scripting (XSS) Vulnerability | 8.0.0 – < 10.3.14 ; 10.4.0 – < 10.4.5 ; 11.0.0 – < 11.0.13 ; … | Undetermined |
| GHSA-m648-hpf8-qcjw Drupal Core Cross-Site Request Forgery (CSRF) vulnerability | 8.9.0 – < 8.9.1 ; 9.0.0 – < 9.0.1 ; 7.0.0 – < 7.72 ; … | Undetermined |
| GHSA-m6ch-gg5f-wxx3 HTTP Proxy header vulnerability | 8.0 – < 8.1.7 | Undetermined |
| GHSA-m6q5-wv4x-fv6h Cross-site Scripting in Drupal Core | 8.0.0 – < 8.8.10 ; 8.9.0 – < 8.9.6 ; 9.0.0 – < 9.0.6 | Undetermined |
| GHSA-m6vv-vcj8-w8m7 Drupal core allows Object Injection | 8.0.0 – < 10.4.9 ; 10.5.0 – < 10.5.6 ; 11.0.0 – < 11.1.9 ; … | Undetermined |
| GHSA-mg8j-w93w-xjgc Drupal Full Path Disclosure | 10.3.0 – < 10.3.6 ; 11.0.0 – < 11.0.5 ; 8.0.0 – < 10.2.9 | Undetermined |
| GHSA-mh4h-27gq-cxwj Drupal core Access bypass | 8.0.0 – < 8.7.11 ; 8.8.0 – < 8.8.1 | Undetermined |
| GHSA-mhpg-hpj5-73r2 Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels | 8.0.0 – < 10.4.9 ; 10.5.0 – < 10.5.6 ; 11.0.0 – < 11.1.9 ; … | Undetermined |
| GHSA-mmjr-5q74-p3m4 Exposure of Resource to Wrong Sphere in Drupal Core | 8.0.0 – < 8.8.10 ; 8.9.0 – < 8.9.6 ; 9.0.0 – < 9.0.6 | Undetermined |
| GHSA-p745-347h-hjfw Drupal sensitive information disclosure | 7.0 – < 7.52 ; 8.0 – < 8.2.3 | Undetermined |
| GHSA-p8g6-5mg7-9r5q Drupal REST API can bypass comment approval | 8.0 – < 8.3.7 | Undetermined |
| GHSA-pqv4-xgqh-j8vh Drupal sensitive information disclosure | 7.0 – < 7.43 ; 8.0 – < 8.0.4 | Undetermined |
| GHSA-pr99-c33p-fwf6 Drupal core Denial of Service | 8.0.0 – < 8.7.11 ; 8.8.0 – < 8.8.1 | Undetermined |
| GHSA-pw6f-3999-xp7g Drupal core allows Cross-Site Scripting (XSS) | 11.3.0 – < 11.3.7 | Undetermined |
| GHSA-q3p9-8728-wq7x Drupal saving user accounts can sometimes grant the user all roles | 6.0 – < 6.38 ; 7.0 – < 7.43 | Undetermined |
| GHSA-qf2g-mrrx-rr5p Drupal Core Cross-site scripting vulnerability | 8.8.0 – < 8.8.10 ; 8.9.0 – < 8.9.6 ; 9.0.0 – < 9.0.6 | Undetermined |
| GHSA-qfhg-m6r8-xxpj Incorrect Authorization in Drupal core | 8.0.0 – < 8.9.19 ; 9.1.0 – < 9.1.13 ; 9.2.0 – < 9.2.6 | Undetermined |
| GHSA-qp8q-gwf5-hqh2 Drupal Cross-Site Scripting vulnerability | 6.20 | Not affected |
| GHSA-qqxc-cppg-4xp8 Drupal Reflected file download vulnerability | 6.0 – < 6.38 ; 7.0 – < 7.43 | Undetermined |
| GHSA-rfxx-gxwc-923c Drupal Views can allow unauthorized users to see Statistics information | 8.0 – < 8.1.3 | Undetermined |
| GHSA-rgx6-rjj4-c388 ckeditor4 vulnerable to cross-site scripting | 7.0.0 – < 7.80 ; 8.0.0 – < 8.9.16 ; 9.0.0 – < 9.0.14 ; … | Undetermined |
| GHSA-rhx9-3qf7-r3j7 Drupal Remote code execution | 8.0 – < 8.2.7 | Undetermined |
| GHSA-rjqg-3h9m-fx5x Cache poisoning in drupal/core | 8.7.0 – < 9.5.11 ; 10.0.0 – < 10.0.11 ; 10.1.0 – < 10.1.4 | Undetermined |
| GHSA-v273-j5hq-26xp Drupal core uses a vulnerable Third-party library CKEditor | 8.0.0 – < 8.7.12 ; 8.8.0 – < 8.8.4 | Undetermined |
| GHSA-v3f6-f29f-rgvp Missing Authorization in Drupal | 8.0 – < 8.3.7 | Undetermined |
| GHSA-v8wr-r69p-mmwx Unrestricted Upload of File with Dangerous Type in Drupal core | 8.0.0 – < 8.9.19 ; 9.1.0 – < 9.1.13 ; 9.2.0 – < 9.2.6 | Undetermined |
| GHSA-vfgc-c76h-mwh4 Drupal core Cross-Site Scripting (XSS) vulnerabilities | 8.0.0 – < 8.9.18 ; 9.1.0 – < 9.1.12 ; 9.2.0 – < 9.2.4 | Undetermined |
| GHSA-vhg8-x858-7wq6 Drupal Cross-site scripting (XSS) vulnerability | 8.0 – < 8.1.10 | Undetermined |
| GHSA-w2pj-c8x5-jvg2 Drupal File upload access bypass and denial of service | 7.0 – < 7.43 ; 8.0 – < 8.0.4 | Undetermined |
| GHSA-w6rx-9g2x-mg5g Drupal core contains a potential PHP Object Injection vulnerability | 8.8.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 ; 11.0.0 – < 11.0.8 | Undetermined |
| GHSA-w7qx-vwr9-2j3r Drupal editor module incorrectly checks access to inline private files | 8.2.0 – < 8.2.7 | Undetermined |
| GHSA-wm86-w3cf-h6vm Drupal external link injection vulnerability | 7.0 – < 7.57 | Undetermined |
| GHSA-wpp8-fjgf-pwc7 Drupal Core Vulnerable to Forceful Browsing | 8.0.0 – < 10.3.13 ; 10.4.0 – < 10.4.3 ; 11.0.0 – < 11.0.12 ; … | Undetermined |
| GHSA-wxqp-jwc9-g39x Drupal Core Access bypass vulnerability | 8.8.0 – < 8.8.8 ; 8.9.0 – < 8.9.1 ; 9.0.0 – < 9.0.1 | Undetermined |
| GHSA-x2q9-r8gm-f657 Drupal Core Access bypass vulnerability | 8.8.0 – < 8.8.10 ; 8.9.0 – < 8.9.6 ; 9.0.0 – < 9.0.6 | Undetermined |
| GHSA-x72f-ggjw-v5xh Drupal Core Arbitrary PHP code execution vulnerability | 8.8.0 – < 8.8.8 ; 8.9.0 – < 8.9.1 ; 9.0.0 – < 9.0.1 | Undetermined |
| GHSA-xh3v-6f9j-wxw3 Drupal core Information Disclosure vulnerability | 7.0.0 – < 7.91 ; 8.0.0 – < 9.3.19 ; 9.4.0 – < 9.4.3 | Undetermined |
| GHSA-xmjc-63pr-2mpg Drupal core allows Object Injection | 8.0.0 – < 10.5.9 ; 10.6.0 – < 10.6.7 ; 11.0.0 – < 11.2.11 ; … | Undetermined |
| GHSA-xq54-x54m-vcpx Drupal core Denial of Service | 10.1.0 – < 10.1.8 ; 10.2.0 – < 10.2.2 | Undetermined |
| GHSA-xq62-62c9-22mg Drupal Improper Access Control | 8.7.4 – < 8.7.5 | Undetermined |
| GHSA-xv7v-rf6g-xwrc Directory Traversal in typo3/phar-stream-wrapper | 7.0.0 – < 7.67.0 ; 8.0.0 – < 8.6.16 ; 8.7.0 – < 8.7.1 | Undetermined |
Sources
| Source | Licence |
|---|