Drupal core vulnerabilities

CVEs per yearBy the year they were published

1. 20181
2. 202210
3. 20238

Known exploitedNewest addition to KEV first

• CVE-2018-7602

  Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

  Drupal · core

  ExploitedHigh8.1

Newest CVEs

• CVE-2023-5256

  Drupal core - Critical - Cache poisoning - SA-CORE-2023-006

  Drupal · Core

  High7.5
• CVE-2023-31250

  Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005

  Drupal · Core

  Medium6.5
• CVE-2022-25278

  Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should…

  Drupal · Core

  Medium6.5
• CVE-2022-25277

  Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to…

  Drupal · Core

  High7.2
• CVE-2022-25276

  The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain.…

  Drupal · Core

  Medium6.1
• CVE-2022-25275

  In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating…

  Drupal · Core

  High7.5
• CVE-2022-25274

  Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting…

  Drupal · Core

  Medium5.4
• CVE-2022-25273

  Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow…

  Drupal · Core

  High7.5
• CVE-2022-25270

  The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission…

  Drupal · Core

  Medium6.5
• CVE-2022-25271

  Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow…

  Drupal · Core

  High7.5