drupal/core vulnerabilities
Drupal is an open source content management platform powering millions of websites and applications.
- Registry
- Composer
- Latest
- 11.4.11
- License
- GPL-2.0-or-later
201 known advisories
The latest version, 11.4.11, is not affected by any of them. Projects on older versions may be.
composer require drupal/core:^11.4.11Security advisories for drupal/core
No summary published
- Affected
- >=10.3.0 <10.6.19 · >=11.0.0 <11.3.19 · >=11.4.0 <11.4.10 · >=12.0.0-alpha1 <12.0.0-beta2
- Fixed in
- 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2
No summary published
- Affected
- >=8.9.0 <10.6.19 · >=11.0.0 <11.3.19 · >=11.4.0 <11.4.10 · >=12.0.0-alpha1 <12.0.0-beta2
- Fixed in
- 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2
No summary published
- Affected
- >=8.9.0 <10.6.19 · >=11.0.0 <11.3.19 · >=11.4.0 <11.4.10 · >=12.0.0-alpha1 <12.0.0-beta2
- Fixed in
- 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2
No summary published
- Affected
- >=10.5.0 <10.6.17 · >=11.0.0 <11.3.17 · >=11.4.0 <11.4.7
- Fixed in
- 10.6.17, 11.3.17, 11.4.7
No summary published
- Affected
- <10.6.13 · >=11.3.0 <11.3.14 · >=11.4.0 <11.4.4 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0 · >=11.2.0 <11.3.0
- Fixed in
- 10.6.13, 11.1.0, 11.2.0, 11.3.0, 11.3.14, 11.4.4
No summary published
- Affected
- >=11.3.0 <11.3.14 · >=11.4.0 <11.4.4 · >=11.2.0 <11.3.0
- Fixed in
- 11.3.0, 11.3.14, 11.4.4
No summary published
- Affected
- <10.6.13 · >=11.3.0 <11.3.14 · >=11.4.0 <11.4.4 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0 · >=11.2.0 <11.3.0
- Fixed in
- 10.6.13, 11.1.0, 11.2.0, 11.3.0, 11.3.14, 11.4.4
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
Drupal Core has a SQL Injection issue
- Affected
- >=8.9.0 <10.4.10 · >=10.5.0 <10.5.10 · >=10.6.0 <10.6.9 · >=11.0.0 <11.1.10 · >=11.2.0 <11.2.12 · >=11.3.0 <11.3.10
- Fixed in
- 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10
No summary published
- Affected
- >=8.9.0 <10.4.10 · >=10.5.0 <10.5.10 · >=10.6.0 <10.6.9 · >=11.0.0 <11.1.10 · >=11.2.0 <11.2.12 · >=11.3.0 <11.3.10
- Fixed in
- 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10
Drupal core is Vulnerable to Cross-Site Scripting
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
Drupal core allows Cross-Site Scripting (XSS)
- Affected
- >=11.3.0 <11.3.7
- Fixed in
- 11.3.7
Drupal core allows Object Injection
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
No summary published
- Affected
- >=11.3.0 <11.3.7
- Fixed in
- 11.3.7
No summary published
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
No summary published
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
Drupal core allows Object Injection
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
Drupal core allows Forceful Browsing
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
Drupal core allows Content Spoofing
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8 · >=7.0 <7.103
- Fixed in
- 7.103, 10.4.9, 10.5.6, 11.1.9, 11.2.8
No summary published
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
No summary published
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
No summary published
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
No summary published
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
Drupal Core Vulnerable to Forceful Browsing
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
Drupal Core Cross-Site Scripting (XSS) Vulnerability
- Affected
- >=8.0.0 <10.3.14 · >=10.4.0 <10.4.5 · >=11.0.0 <11.0.13 · >=11.1.0 <11.1.5
- Fixed in
- 10.3.14, 10.4.5, 11.0.13, 11.1.5
No summary published
- Affected
- >=8.0.0 <10.3.14 · >=10.4.0 <10.4.5 · >=11.0.0 <11.0.13 · >=11.1.0 <11.1.5
- Fixed in
- 10.3.14, 10.4.5, 11.0.13, 11.1.5
No summary published
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
No summary published
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
No summary published
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
Drupal core contains a potential PHP Object Injection vulnerability
- Affected
- >=8.8.0 <10.2.11 · >=10.3.0 <10.3.9 · >=7.0 <7.102
- Fixed in
- 7.102, 10.2.11, 10.3.9
Drupal core contains a potential PHP Object Injection vulnerability
- Affected
- >=8.8.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
Drupal core Access bypass
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
Drupal core contains a potential PHP Object Injection vulnerability
- Affected
- >=8.8.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
Drupal Core Cross-Site Scripting (XSS)
- Affected
- >=8.8.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
Drupal core Denial of Service
- Affected
- >=10.1.0 <10.1.8 · >=10.2.0 <10.2.2
- Fixed in
- 10.1.8, 10.2.2
Drupal core vulnerable to improper error handling
- Affected
- >=10.0.0 <10.2.10
- Fixed in
- 10.2.10
No summary published
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9
- Fixed in
- 10.2.11, 10.3.9
No summary published
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
No summary published
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
No summary published
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
No summary published
- Affected
- >=8.8.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
No summary published
- Affected
- >=10.0.0 <10.2.10
- Fixed in
- 10.2.10
Drupal Full Path Disclosure
- Affected
- >=10.3.0 <10.3.6 · >=11.0.0 <11.0.5 · >=8.0.0 <10.2.9
- Fixed in
- 10.2.9, 10.3.6, 11.0.5
Drupal core Cross-Site Scripting (XSS) vulnerabilities
- Affected
- >=8.0.0 <8.9.18 · >=9.1.0 <9.1.12 · >=9.2.0 <9.2.4
- Fixed in
- 8.9.18, 9.1.12, 9.2.4
Drupal core Arbitrary PHP code execution
- Affected
- >=7.0.0 <7.75 · >=8.0.0 <8.8.12 · >=8.9.0 <8.9.10 · >=9.0.0 <9.0.9
- Fixed in
- 7.75, 8.8.12, 8.9.10, 9.0.9
Drupal core Open Redirect vulnerability
- Affected
- >=7.0.0 <7.70
- Fixed in
- 7.70
Drupal core uses a vulnerable Third-party library CKEditor
- Affected
- >=8.0.0 <8.7.12 · >=8.8.0 <8.8.4
- Fixed in
- 8.7.12, 8.8.4
Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
- Affected
- >=7.0.0 <7.69 · >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 7.69, 8.7.11, 8.8.1
Drupal core Access bypass
- Affected
- >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 8.7.11, 8.8.1
Drupal core unrestricted file upload
- Affected
- >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 8.7.11, 8.8.1
Drupal core Denial of Service
- Affected
- >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 8.7.11, 8.8.1
Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution
- Affected
- >=8.0.0 <8.5.8 · >=8.6.0 <8.6.2
- Fixed in
- 8.5.8, 8.6.2
Drupal core Remote Code Execution
- Affected
- >=7.0 <7.60 · >=8.0.0 <8.5.8 · >=8.6.0 <8.6.2
- Fixed in
- 7.60, 8.5.8, 8.6.2
Drupal Anonymous Open Redirect
- Affected
- >=8.0.0 <8.5.8 · >=8.6.0 <8.6.2
- Fixed in
- 8.5.8, 8.6.2
Drupal External URL injection through URL aliases leading to Open Redirect
- Affected
- >=7.0 <7.60 · >=8.0.0 <8.5.8 · >=8.6.0 <8.6.2
- Fixed in
- 7.60, 8.5.8, 8.6.2
Drupal Content moderation Access bypass
- Affected
- >=8.0.0 <8.5.8 · >=8.6.0 <8.6.2
- Fixed in
- 8.5.8, 8.6.2
Drupal Core Remote Code Execution Vulnerability
- Affected
- >=7.0 <7.59 · >=8.0 <8.4.8 · >=8.5 <8.5.3
- Fixed in
- 7.59, 8.4.8, 8.5.3
Drupal core Denial of Service vulnerability
- Affected
- >=8.0.0 <10.1.8 · >=10.2.0 <10.2.2
- Fixed in
- 10.1.8, 10.2.2
No summary published
- Affected
- >=8.0.0 <10.1.8 · >=10.2.0 <10.2.2
- Fixed in
- 10.1.8, 10.2.2
Drupal Denial of Service vulnerability
- Affected
- 9.3.6
- Fixed in
- No fix released
Drupal Improper Access Control
- Affected
- >=8.7.4 <8.7.5
- Fixed in
- 8.7.5
Cache poisoning in drupal/core
- Affected
- >=8.7.0 <9.5.11 · >=10.0.0 <10.0.11 · >=10.1.0 <10.1.4
- Fixed in
- 9.5.11, 10.0.11, 10.1.4
No summary published
- Affected
- >=8.7.0 <9.5.11 · >=10.0.0 <10.0.11 · >=10.1.0 <10.1.4
- Fixed in
- 9.5.11, 10.0.11, 10.1.4
Access bypass in Drupal core
- Affected
- >=10.0.0 <10.0.8 · >=9.5.0 <9.5.8 · >=9.0.0 <9.4.14 · >=7.0.0 <7.96
- Fixed in
- 7.96, 9.4.14, 9.5.8, 10.0.8
Improper input validation in Drupal core
- Affected
- >=8.0.0 <9.2.18 · >=9.3.0 <9.3.12
- Fixed in
- 9.2.18, 9.3.12
Lack of domain validation in Druple core
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
Access bypass in Drupal core
- Affected
- >=9.3.0 <9.3.12
- Fixed in
- 9.3.12
Access bypass in Drupal Core
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.4.14 · >=9.5.0 <9.5.8 · >=10.0.0 <10.0.8
- Fixed in
- 9.4.14, 9.5.8, 10.0.8
No summary published
- Affected
- >=8.0.0 <9.4.12 · >=9.5.0 <9.5.5 · >=10.0.0 <10.0.5
- Fixed in
- 9.4.12, 9.5.5, 10.0.5
No summary published
- Affected
- >=8.0.0 <9.4.12 · >=9.5.0 <9.5.5 · >=10.0.0 <10.0.5
- Fixed in
- 9.4.12, 9.5.5, 10.0.5
No summary published
- Affected
- >=8.0.0 <9.4.12 · >=9.5.0 <9.5.5 · >=10.0.0 <10.0.5
- Fixed in
- 9.4.12, 9.5.5, 10.0.5
No summary published
- Affected
- >=8.0.0 <9.4.10 · >=9.5.0 <9.5.2 · >=10.0.0 <10.0.2
- Fixed in
- 9.4.10, 9.5.2, 10.0.2
No summary published
- Affected
- >=8.0.0 <9.3.22 · >=9.4.0 <9.4.7
- Fixed in
- 9.3.22, 9.4.7
Drupal core arbitrary PHP code execution
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
Drupal core Information Disclosure vulnerability
- Affected
- >=7.0.0 <7.91 · >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 7.91, 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.2.21 · >=9.3.0 <9.3.16
- Fixed in
- 9.2.21, 9.3.16
No summary published
- Affected
- >=8.0.0 <9.2.20 · >=9.3.0 <9.3.14
- Fixed in
- 9.2.20, 9.3.14
Drupal Core Cross-site scripting vulnerability
- Affected
- >=8.8.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability
- Affected
- >=8.9.0 <8.9.1 · >=9.0.0 <9.0.1 · >=7.0.0 <7.72 · >=8.0.0 <8.8.8
- Fixed in
- 7.72, 8.8.8, 8.9.1, 9.0.1
Drupal Core Access bypass vulnerability
- Affected
- >=8.8.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
Drupal Core Access bypass vulnerability
- Affected
- >=8.8.0 <8.8.8 · >=8.9.0 <8.9.1 · >=9.0.0 <9.0.1
- Fixed in
- 8.8.8, 8.9.1, 9.0.1
Drupal Core Arbitrary PHP code execution vulnerability
- Affected
- >=8.8.0 <8.8.8 · >=8.9.0 <8.9.1 · >=9.0.0 <9.0.1
- Fixed in
- 8.8.8, 8.9.1, 9.0.1
Drupal Core Cross-site scripting vulnerability
- Affected
- >=8.8.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6 · >=7.0.0 <7.73
- Fixed in
- 7.73, 8.8.10, 8.9.6, 9.0.6
Drupal Core Open Redirect vulnerability
- Affected
- >=7.0.0 <7.70
- Fixed in
- 7.70
Drupal Cross Site Scripting (XSS) vulnerability
- Affected
- >=7.0.0 <7.65.0 · >=8.0.0 <8.5.14 · >=8.6.0 <8.6.13
- Fixed in
- 7.65.0, 8.5.14, 8.6.13
Drupal Access Control Bypass
- Affected
- >=7.0 <7.3
- Fixed in
- 7.3
Drupal Open Redirect
- Affected
- >=8.0 <8.0.4 · >=7.0 <7.43 · >=6.0 <6.38
- Fixed in
- 6.38, 7.43, 8.0.4
Drupal CRLF injection vulnerability in the drupal_set_header function
- Affected
- >=6.0 <6.38
- Fixed in
- 6.38
Drupal Form API ignores access restrictions on submit buttons
- Affected
- >=6.0 <6.38
- Fixed in
- 6.38
Drupal saving user accounts can sometimes grant the user all roles
- Affected
- >=6.0 <6.38 · >=7.0 <7.43
- Fixed in
- 6.38, 7.43
Drupal Reflected file download vulnerability
- Affected
- >=6.0 <6.38 · >=7.0 <7.43
- Fixed in
- 6.38, 7.43
Drupal sensitive information disclosure
- Affected
- >=7.0 <7.43 · >=8.0 <8.0.4
- Fixed in
- 7.43, 8.0.4
Drupal Brute force amplification attacks via XML-RPC
- Affected
- >=7.0 <7.43 · >=6.0 <6.38
- Fixed in
- 6.38, 7.43
Drupal Open redirect vulnerability in the drupal_goto function
- Affected
- >=6.0 <6.38
- Fixed in
- 6.38
Drupal File upload access bypass and denial of service
- Affected
- >=7.0 <7.43 · >=8.0 <8.0.4
- Fixed in
- 7.43, 8.0.4
Drupal arbitrary code execution
- Affected
- >=6.0 <6.38
- Fixed in
- 6.38
Drupal Users without "Administer comments" can set comment visibility on nodes they can edit
- Affected
- >=8.0.0 <8.1.10
- Fixed in
- 8.1.10
Drupal Unprivileged access to config export
- Affected
- >=8.0 <8.1.10
- Fixed in
- 8.1.10
Drupal Cross-site scripting (XSS) vulnerability
- Affected
- >=8.0 <8.1.10
- Fixed in
- 8.1.10
Drupal Saving user accounts can sometimes grant the user all roles
- Affected
- >=7.0 <7.44
- Fixed in
- 7.44
Drupal Views can allow unauthorized users to see Statistics information
- Affected
- >=8.0 <8.1.3
- Fixed in
- 8.1.3
Drupal Denial of service via transliterate mechanism
- Affected
- >=8.0 <8.2.3
- Fixed in
- 8.2.3
Drupal Incorrect cache context on password reset page
- Affected
- >=8.0 <8.2.3
- Fixed in
- 8.2.3
Drupal Open Redirect
- Affected
- >=7.0 <7.52 · >=8.0 <8.2.3
- Fixed in
- 7.52, 8.2.3
Drupal sensitive information disclosure
- Affected
- >=7.0 <7.52 · >=8.0 <8.2.3
- Fixed in
- 7.52, 8.2.3
Drupal Cross-Site Request Forgery (CSRF)
- Affected
- >=8.2.0 <8.2.7
- Fixed in
- 8.2.7
Drupal cross site scripting vulnerability
- Affected
- >=7.0 <7.57 · >=8.0 <8.4.0
- Fixed in
- 7.57, 8.4.0
Drupal external link injection vulnerability
- Affected
- >=7.0 <7.57
- Fixed in
- 7.57
Drupal cross-site scripting vulnerability
- Affected
- >=8.4.0 <8.4.5 · >=7.0 <7.57
- Fixed in
- 7.57, 8.4.5
Drupal Comment reply form allows access to restricted content
- Affected
- >=8.4.0 <8.4.5 · >=7.0 <7.57
- Fixed in
- 7.57, 8.4.5
Drupal PECL YAML parser unsafe object handling
- Affected
- >=8.0 <8.3.4
- Fixed in
- 8.3.4
Drupal Core Remote Code Execution Vulnerability
- Affected
- >=7.0 <7.58 · >=8.0 <8.3.9 · >=8.4.0 <8.4.6 · >=8.5.0 <8.5.1
- Fixed in
- 7.58, 8.3.9, 8.4.6, 8.5.1
Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)
- Affected
- >=8.5.0 <8.5.2 · >=8.0 <8.4.7
- Fixed in
- 8.4.7, 8.5.2
Drupal access control bypass vulnerability
- Affected
- >=8.0 <8.2.8 · >=8.3.0 <8.3.1
- Fixed in
- 8.2.8, 8.3.1
Drupal Settings Tray access bypass
- Affected
- >=8.4.0 <8.4.5
- Fixed in
- 8.4.5
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
- Affected
- >=8.0 <8.3.7
- Fixed in
- 8.3.7
Drupal access bypass vulnerability
- Affected
- >=8.4.0 <8.4.5
- Fixed in
- 8.4.5
Drupal access bypass vulnerability
- Affected
- >=7.0 <7.57
- Fixed in
- 7.57
Drupal Remote code execution
- Affected
- >=8.0 <8.2.7
- Fixed in
- 8.2.7
Drupal editor module incorrectly checks access to inline private files
- Affected
- >=8.2.0 <8.2.7
- Fixed in
- 8.2.7
Drupal REST API can bypass comment approval
- Affected
- >=8.0 <8.3.7
- Fixed in
- 8.3.7
Drupal core access bypass vulnerability
- Affected
- >=7.0 <7.56 · >=8.0 <8.3.4
- Fixed in
- 7.56, 8.3.4
Drupal file REST resource does not properly validate
- Affected
- >=8.0 <8.3.4
- Fixed in
- 8.3.4
Drupal Core Remote Code Execution Vulnerability
- Affected
- >=8.6.0 <8.6.10 · >=7.0.0 <7.62.0 · >=8.0.0 <8.5.11
- Fixed in
- 7.62.0, 8.5.11, 8.6.10
Drupal SQL Injection vulnerability
- Affected
- 6.20
- Fixed in
- No fix released
Drupal Cross-Site Scripting vulnerability
- Affected
- 6.20
- Fixed in
- No fix released
No summary published
- Affected
- >=9.3.0 <9.3.12
- Fixed in
- 9.3.12
No summary published
- Affected
- >=8.0.0 <9.2.18 · >=9.3.0 <9.3.12
- Fixed in
- 9.2.18, 9.3.12
HTTP Proxy header vulnerability
- Affected
- >=8.0 <8.1.7
- Fixed in
- 8.1.7
No summary published
- Affected
- >=8.0.0 <9.2.16 · >=9.3.0 <9.3.9
- Fixed in
- 9.2.16, 9.3.9
No summary published
- Affected
- >=8.0.0 <9.2.15 · >=9.3.0 <9.3.8
- Fixed in
- 9.2.15, 9.3.8
Improper input validation in Drupal core
- Affected
- >=9.3.0 <9.3.6 · >=8.0.0 <9.2.13 · >=7.0.0 <7.88
- Fixed in
- 7.88, 9.2.13, 9.3.6
Incorrect authorization in Drupal core
- Affected
- >=9.3.0 <9.3.6 · >=8.0.0 <9.2.13
- Fixed in
- 9.2.13, 9.3.6
No summary published
- Affected
- >=8.0.0 <9.2.13 · >=9.3.0 <9.3.6
- Fixed in
- 9.2.13, 9.3.6
No summary published
- Affected
- >=8.0.0 <9.2.13 · >=9.3.0 <9.3.6
- Fixed in
- 9.2.13, 9.3.6
Unrestricted Upload of File with Dangerous Type in Drupal core
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
Exposure of Resource to Wrong Sphere in Drupal Core
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
Drupal core Cross-site Scripting (XSS) vulnerability
- Affected
- >=7.0.0 <7.80 · >=8.0.0 <8.9.14 · >=9.0.0 <9.0.12 · >=9.1.0 <9.1.7
- Fixed in
- 7.80, 8.9.14, 9.0.12, 9.1.7
Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
Cross-Site Request Forgery in Drupal core
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
Cross-site Scripting in Drupal Core
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
Drupal core access bypass vulnerability
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
Incorrect Authorization in Drupal core
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
No summary published
- Affected
- >=8.0.0 <9.2.11 · >=9.3.0 <9.3.3
- Fixed in
- 9.2.11, 9.3.3
Arbitrary PHP code execution in Drupal
- Affected
- >=7.0.0 <7.62.0 · >=8.0.0 <8.5.9 · >=8.6.0 <8.6.6
- Fixed in
- 7.62.0, 8.5.9, 8.6.6
No summary published
- Affected
- >=8.0.0 <8.9.20 · >=9.1.0 <9.1.14 · >=9.2.0 <9.2.9
- Fixed in
- 8.9.20, 9.1.14, 9.2.9
Drupal core Unrestricted Upload of File with Dangerous Type
- Affected
- >=9.0.0 <9.0.8 · >=8.9.0 <8.9.9 · >=8.0.0 <8.8.11 · >=7.0.0 <7.74
- Fixed in
- 7.74, 8.8.11, 8.9.9, 9.0.8
Directory Traversal in typo3/phar-stream-wrapper
- Affected
- >=7.0.0 <7.67.0 · >=8.0.0 <8.6.16 · >=8.7.0 <8.7.1
- Fixed in
- 7.67.0, 8.6.16, 8.7.1
No summary published
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
No summary published
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
No summary published
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
No summary published
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
No summary published
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
No summary published
- Affected
- >=8.0.0 <8.9.18 · >=9.1.0 <9.1.12 · >=9.2.0 <9.2.4
- Fixed in
- 8.9.18, 9.1.12, 9.2.4
No summary published
- Affected
- >=8.0.0 <8.9.17 · >=9.1.0 <9.1.11 · >=9.2.0 <9.2.2
- Fixed in
- 8.9.17, 9.1.11, 9.2.2
ckeditor4 vulnerable to cross-site scripting
- Affected
- >=7.0.0 <7.80 · >=8.0.0 <8.9.16 · >=9.0.0 <9.0.14 · >=9.1.0 <9.1.9
- Fixed in
- 7.80, 8.9.16, 9.0.14, 9.1.9
No summary published
- Affected
- >=8.0.0 <8.9.16 · >=9.0.0 <9.0.14 · >=9.1.0 <9.1.9
- Fixed in
- 8.9.16, 9.0.14, 9.1.9
No summary published
- Affected
- >=8.0.0 <8.9.14 · >=9.0.0 <9.0.12 · >=9.1.0 <9.1.7
- Fixed in
- 8.9.14, 9.0.12, 9.1.7
No summary published
- Affected
- >=8.0.0 <8.9.13 · >=9.0.0 <9.0.11 · >=9.1.0 <9.1.3
- Fixed in
- 8.9.13, 9.0.11, 9.1.3
No summary published
- Affected
- >=8.0.0 <8.8.12 · >=8.9.0 <8.9.10 · >=9.0.0 <9.0.9
- Fixed in
- 8.8.12, 8.9.10, 9.0.9
No summary published
- Affected
- >=8.0.0 <8.8.11 · >=8.9.0 <8.9.9 · >=9.0.0 <9.0.8
- Fixed in
- 8.8.11, 8.9.9, 9.0.8
No summary published
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
No summary published
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
No summary published
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
No summary published
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
No summary published
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
No summary published
- Affected
- >=8.0.0 <8.8.8 · >=8.9.0 <8.9.1 · >=9.0.0 <9.0.1
- Fixed in
- 8.8.8, 8.9.1, 9.0.1
No summary published
- Affected
- >=8.0.0 <8.8.8 · >=8.9.0 <8.9.1 · >=9.0.0 <9.0.1
- Fixed in
- 8.8.8, 8.9.1, 9.0.1
No summary published
- Affected
- >=8.0.0 <8.8.8 · >=8.9.0 <8.9.1 · >=9.0.0 <9.0.1
- Fixed in
- 8.8.8, 8.9.1, 9.0.1
No summary published
- Affected
- >=8.0.0 <8.7.14 · >=8.8.0 <8.8.6
- Fixed in
- 8.7.14, 8.8.6
No summary published
- Affected
- >=8.0.0 <8.7.12 · >=8.8.0 <8.8.4
- Fixed in
- 8.7.12, 8.8.4
No summary published
- Affected
- >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 8.7.11, 8.8.1
No summary published
- Affected
- >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 8.7.11, 8.8.1
No summary published
- Affected
- >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 8.7.11, 8.8.1
No summary published
- Affected
- >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 8.7.11, 8.8.1
Symfony Cross-site Scripting (XSS) vulnerability
- Affected
- >=8.0.0 <8.5.15 · >=8.6.0 <8.6.15
- Fixed in
- 8.5.15, 8.6.15
Missing Authorization in Drupal
- Affected
- >=8.0 <8.3.7
- Fixed in
- 8.3.7
No summary published
- Affected
- >=8.7.4 <8.7.5
- Fixed in
- 8.7.5
No summary published
- Affected
- >=8.0.0 <8.6.16 · >=8.7.0 <8.7.1
- Fixed in
- 8.6.16, 8.7.1
No summary published
- Affected
- >=8.0.0 <8.5.15 · >=8.6.0 <8.6.15
- Fixed in
- 8.5.15, 8.6.15
No summary published
- Affected
- >=8.0.0 <8.5.15 · >=8.6.0 <8.6.15
- Fixed in
- 8.5.15, 8.6.15
No summary published
- Affected
- >=8.0.0 <8.5.14 · >=8.6.0 <8.6.13
- Fixed in
- 8.5.14, 8.6.13
No summary published
- Affected
- >=8.0.0 <8.5.11 · >=8.6.0 <8.6.10
- Fixed in
- 8.5.11, 8.6.10
No summary published
- Affected
- >=8.0.0 <8.5.9 · >=8.6.0 <8.6.6
- Fixed in
- 8.5.9, 8.6.6
No summary published
- Affected
- >=8.0.0 <8.5.9 · >=8.6.0 <8.6.6
- Fixed in
- 8.5.9, 8.6.6
No summary published
- Affected
- >=8.0.0 <8.4.8 · >=8.5.0 <8.5.3
- Fixed in
- 8.4.8, 8.5.3
No summary published
- Affected
- >=8.0.0 <8.4.7 · >=8.5.0 <8.5.2
- Fixed in
- 8.4.7, 8.5.2
No summary published
- Affected
- >=8.0.0 <8.3.9 · >=8.4.0 <8.4.6 · >=8.5.0 <8.5.1
- Fixed in
- 8.3.9, 8.4.6, 8.5.1
No summary published
- Affected
- >=8.0.0 <8.4.5
- Fixed in
- 8.4.5
Which of your client projects still run an old drupal/core?
NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other Composer packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.