Drupal Drupal core
49 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-15916 | 0.0.0 – < 10.6.13 ; 11.3.0 – < 11.3.14 ; 11.4.0 – < 11.4.4 ; … | Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010 | MEDIUM 4.2 | 0.2 % | ||
| CVE-2026-15917 | 11.3.0 – < 11.3.14 ; 11.4.0 – < 11.4.4 ; 0.0.0 – < 11.2.* | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011 | MEDIUM 4.7 | 0.2 % | ||
| CVE-2026-55805 | 0.0.0 – < 10.6.13 ; 11.3.0 – < 11.3.14 ; 11.4.0 – < 11.4.4 ; … | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012 | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-55808 | 0.0.0 – < 10.5.12 ; 10.6.0 – < 10.6.11 ; 11.2.0 – < 11.2.14 ; … | Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009 | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-55807 | 0.0.0 – < 10.5.12 ; 10.6.0 – < 10.6.11 ; 11.2.0 – < 11.2.14 ; … | Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008 | LOW 3.1 | 0.2 % | ||
| CVE-2026-55806 | 0.0.0 – < 10.5.12 ; 10.6.0 – < 10.6.11 ; 11.2.0 – < 11.2.14 ; … | Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007 | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-55804 | 0.0.0 – < 10.5.12 ; 10.6.0 – < 10.6.11 ; 11.2.0 – < 11.2.14 ; … | Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006 | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-55803 | 0.0.0 – < 10.5.12 ; 10.6.0 – < 10.6.11 ; 11.2.0 – < 11.2.14 ; … | Drupal core - Critical - PHP object injection - SA-CORE-2026-005 | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-9082 | 8.9.0 – < 10.4.10 ; 10.5.0 – < 10.5.10 ; 10.6.0 – < 10.6.9 ; … | Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 | CRITICAL 9.8 | 89 % | KEV | |
| CVE-2026-6367 | 11.3.0 – < 11.3.7 | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003 | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-6366 | 8.0.0 – < 10.5.9 ; 10.6.0 – < 10.6.7 ; 11.0.0 – < 11.2.11 ; … | Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002 | MEDIUM 6.6 | 0.4 % | ||
| CVE-2026-6365 | 8.0.0 – < 10.5.9 ; 10.6.0 – < 10.6.7 ; 11.0.0 – < 11.2.11 ; … | Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001 | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-13083 | 8.0.0 – < 10.4.9 ; 10.5.0 – < 10.5.6 ; 11.0.0 – < 11.1.9 ; … | Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008 | LOW 3.7 | 0.3 % | ||
| CVE-2025-13082 | 8.0.0 – < 10.4.9 ; 10.5.0 – < 10.5.6 ; 11.0.0 – < 11.1.9 ; … | Drupal core - Moderately critical - Defacement - SA-CORE-2025-007 | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-13081 | 8.0.0 – < 10.4.9 ; 10.5.0 – < 10.5.6 ; 11.0.0 – < 11.1.9 ; … | Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006 | MEDIUM 5.9 | 0.3 % | ||
| CVE-2025-13080 | 8.0.0 – < 10.4.9 ; 10.5.0 – < 10.5.6 ; 11.0.0 – < 11.1.9 ; … | Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005 | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-31675 | 8.0.0 – < 10.3.14 ; 10.4.0 – < 10.4.5 ; 11.0.0 – < 11.0.13 ; … | Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004 | MEDIUM 5.4 | 0.5 % | ||
| CVE-2025-31674 | 8.0.0 – < 10.3.13 ; 10.4.0 – < 10.4.3 ; 11.0.0 – < 11.0.12 ; … | Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003 | HIGH 7.5 | 0.6 % | ||
| CVE-2025-31673 | 8.0.0 – < 10.3.13 ; 10.4.0 – < 10.4.3 ; 11.0.0 – < 11.0.12 ; … | Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002 | MEDIUM 4.6 | 0.3 % | ||
| CVE-2025-3057 | 8.0.0 – < 10.3.13 ; 10.4.0 – < 10.4.3 ; 11.0.0 – < 11.0.12 ; … | Drupal core - Critical - Cross site scripting - SA-CORE-2025-001 | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-55638 | 7.0 – < 7.102 ; 8.0.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 | Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008 | CRITICAL 9.8 | 1.0 % | ||
| CVE-2024-55637 | 8.0.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 ; 11.0.0 – < 11.0.8 | Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007 | CRITICAL 9.8 | 0.8 % | ||
| CVE-2024-55636 | 8.0.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 ; 11.0.0 – < 11.0.8 | Drupal core - Less critical - Gadget chain - SA-CORE-2024-006 | CRITICAL 9.8 | 0.9 % | ||
| CVE-2024-55635 | 7.0 – < 7.102 | Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005 | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-55634 | 8.0.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 ; 11.0.0 – < 11.0.8 | Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004 | HIGH 8.1 | 0.4 % | ||
| CVE-2024-12393 | 8.8.0 – < 10.2.11 ; 10.3.0 – < 10.3.9 ; 11.0.0 – < 11.0.8 | Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003 | MEDIUM 5.4 | 0.3 % | ||
| CVE-2024-11942 | 10.0.0 – < 10.2.10 | Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002 | MEDIUM 5.9 | 0.4 % | ||
| CVE-2024-11941 | 10.2.0 – < 10.2.2 ; 10.1.0 – < 10.1.8 | Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001 | HIGH 7.5 | 0.5 % | ||
| CVE-2024-45440 | v11.x-dev | core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_co | MEDIUM 5.3 | 9.3 % | ||
| CVE-2020-13688 | 8.8.X – < 8.8.10 ; 8.9.X – < 8.9.6 ; 9.0.X – < 9.0.6 | Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in or | MEDIUM 6.1 | 0.7 % | ||
| CVE-2020-13663 | 7.x – < 7.72 ; 8.8.x – < 8.8.8 ; 8.9.x – < 8.9.1 ; … | Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which | HIGH 8.8 | 0.7 % | ||
| CVE-2020-13667 | 8.8.X – < 8.8.10 ; 8.9.X – < 8.9.6 ; 9.0.X – < 9.0.6 | Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces modul | MEDIUM 5.3 | 0.9 % | ||
| CVE-2020-13664 | 8.8.x – < 8.8.8 ; 8.9.x – < 8.9.1 ; 9.0.1 – < 9.0.1 | Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visitin | HIGH 8.8 | 3.0 % | ||
| CVE-2020-13662 | 7 – 7.70 | Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to a | MEDIUM 6.1 | 0.9 % | ||
| CVE-2020-13665 | 8.8.x – < 8.8.8 ; 8.9.x – < 8.9.1 ; 9.0.x – < 9.0.1 | Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FA | CRITICAL 9.8 | 1.3 % | ||
| CVE-2020-13666 | 7.x – < 7.73 ; 8.8.x – < 8.8.10 ; 8.9.x – < 8.9.6 ; … | Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue | MEDIUM 6.1 | 2.9 % | ||
| CVE-2020-13671 | 9.0 versions prior to 9.0.8 ; 8.9 versions prior to 8.9.9 ; 8.8 versions prior to 8.8.11 ; … | Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect exten | HIGH 8.8 | 36 % | KEV | |
| CVE-2019-6342 | Drupal 8 8.7.4 | Drupal core - Critical - Access bypass - SA-CORE-2019-008 | CRITICAL 9.8 | 2.2 % | ||
| CVE-2019-6341 | Drupal 7 – < 7.65 ; Drupal 8.6 – < 8.6.13 ; Drupal 8.5 – < 8.5.14 | Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004 | MEDIUM 5.4 | 12 % | ||
| CVE-2019-6340 | 8.5 – < 8.5.11 ; 8.6 – < 8.6.10 | Drupal core - Highly critical - Remote Code Execution | HIGH 8.1 | 92 % | KEV | |
| CVE-2017-6923 | 8.x – < 8.3.7 | Access bypass in Drupal 8 views | MEDIUM 6.5 | 2.0 % | ||
| CVE-2019-6339 | 7.x – < 7.62 ; 8.6.x – < 8.6.6. ; 8.5.x – < 8.5.9 | PHAR stream wrapper Arbitrary PHP code execution | CRITICAL 9.8 | 36 % | ||
| CVE-2019-6338 | 7.x – < 7.62 ; 8.6.x – < 8.6.6. ; 8.5.x – < 8.5.9 | third-party PEAR Archive_Tar library updates | HIGH 8.0 | 2.1 % | ||
| CVE-2017-6922 | Drupal 8 – < 8.3.3 ; Drupal 7 – < 7.55 | Files uploaded by anonymous users into a private file system can be accessed by other anonymous users | MEDIUM 6.5 | 1.9 % | ||
| CVE-2017-6921 | Drupal 8 – < 8.3.4 | File REST resource does not properly validate | MEDIUM 5.9 | 1.8 % | ||
| CVE-2017-6924 | Drupal 8 – < 8.3.7 | REST API can bypass comment approval - Access Bypass - Moderately Critical | HIGH 7.4 | 2.1 % | ||
| CVE-2017-6381 | 8.2.x versions before 8.2.7 | A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated b | HIGH 8.1 | 3.9 % | ||
| CVE-2017-6379 | 8.2.x versions before 8.2.7 | Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blo | HIGH 7.5 | 0.8 % | ||
| CVE-2017-6377 | 8.2.x versions before 8.2.7 | When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attach | HIGH 7.5 | 1.9 % |