Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownThe Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.Open the advisoryOct 14, 2026
- UnknownThe Drupal core Link module provides a field type that can be used for internal and external URLs.Open the advisoryOct 14, 2026
- UnknownA remote code execution vulnerability exists within the Field UI module in Drupal core.Open the advisoryOct 14, 2026
- UnknownDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012Check if you run itEPSS 0.23%Jul 15, 2026
- UnknownDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011Check if you run itEPSS 0.13%Jul 15, 2026
- UnknownDrupal core - Moderately critical - Information disclosure - SA-CORE-2026-010Check if you run itEPSS 0.12%Jul 15, 2026
- UnknownDrupal core - Moderately critical - Improper validation - SA-CORE-2026-009Check if you run itEPSS 0.27%Jun 17, 2026
- UnknownDrupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008Check if you run itEPSS 0.22%Jun 17, 2026
- UnknownDrupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007Check if you run itEPSS 0.34%Jun 17, 2026
- UnknownDrupal core - Moderately critical - Gadget chain - SA-CORE-2026-006Check if you run itEPSS 0.35%Jun 17, 2026
- UnknownDrupal core - Critical - PHP object injection - SA-CORE-2026-005Check if you run itEPSS 0.35%Jun 17, 2026
- Medium5.1An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users.Check if you run itEPSS 0.39%May 28, 2026
- High7.4Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation.Check if you run itEPSS 0.34%May 28, 2026
- Medium5.1Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text.Check if you run itEPSS 0.32%May 21, 2026
- Medium5.1In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline.Check if you run itEPSS 0.26%May 21, 2026
- Critical9.8Drupal Core SQL Injection VulnerabilityPatch nowKEVEPSS 15.70%May 20, 2026
- Critical9.8Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing.Check if you run itEPSS 0.49%May 19, 2026
- Medium5.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS).Check if you run itEPSS 0.23%May 19, 2026
- Low2.7Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing.Check if you run itEPSS 0.30%May 19, 2026
- Low3.7Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing.Check if you run itEPSS 0.27%May 19, 2026
- Medium6.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS).Check if you run itEPSS 0.25%May 19, 2026
- Medium6.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS).Check if you run itEPSS 0.25%May 19, 2026
- Medium5.1Drupal avatar_uploader 7.x-1.0-beta8 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manip…Check if you run itEPSS 0.24%May 10, 2026
- Medium6.1Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003Check if you run itEPSS 0.25%Apr 15, 2026
- Medium6.6Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002Check if you run itEPSS 0.42%Apr 15, 2026
107 records · page 1 of 5
PreviousNext