Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (932 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-10927 2 Drupal, Plausible Tracking Project 3 Drupal, Plausible Tracking, Plausible Tracking 2025-12-12 6.1 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2.
CVE-2025-10928 2 Access Code Project, Drupal 3 Access Code, Access Code, Drupal 2025-12-12 6.3 Medium
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.
CVE-2025-10929 2 Drupal, Reverse Proxy Header Project 3 Drupal, Reverse Proxy Header, Reverse Proxy Header 2025-12-12 5.3 Medium
Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.
CVE-2025-12761 2 Drupal, Simple Multi Step Form Project 3 Drupal, Simple Multi Step Form, Simple Multi Step Form 2025-12-08 3.5 Low
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).This issue affects Simple multi step form: from 0.0.0 before 2.0.0.
CVE-2025-12760 2 Drupal, Email Tfa Project 3 Drupal, Email Tfa, Email Tfa 2025-12-08 5.4 Medium
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.
CVE-2025-9553 2 Api Key Manager Project, Drupal 3 Api Key Manager, Api Key Manager, Drupal 2025-12-05 5.3 Medium
Vulnerability in Drupal API Key manager.This issue affects API Key manager: *.*.
CVE-2025-9554 2 Drupal, Owl Carousel 2 Project 2 Drupal, Owl Carousel 2 2025-12-05 5.3 Medium
Vulnerability in Drupal Owl Carousel 2.This issue affects Owl Carousel 2: *.*.
CVE-2025-12466 2 Drupal, Simple Oauth Project 3 Drupal, Openid, Simple Oauth 2025-12-04 7.5 High
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass.This issue affects Simple OAuth (OAuth2) & OpenID Connect: from 6.0.0 before 6.0.7.
CVE-2025-10931 2 Drupal, Umami 3 Drupal, Umami Analytics, Umami Analytics 2025-12-03 3.8 Low
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS).This issue affects Umami Analytics: from 0.0.0 before 1.0.1.
CVE-2025-12082 2 Drupal, Salsa.digital 3 Civictheme Design System, Drupal, Civictheme Design System 2025-12-03 7.5 High
Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
CVE-2025-12083 2 Drupal, Salsa.digital 3 Civictheme Design System, Drupal, Civictheme Design System 2025-12-03 6.1 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
CVE-2025-9954 2 Acquia, Drupal 3 Dam, Acquia Dam, Drupal 2025-12-03 7.5 High
Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5.
CVE-2025-13080 1 Drupal 2 Drupal, Drupal Core 2025-11-24 5.3 Medium
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
CVE-2025-13082 1 Drupal 2 Drupal, Drupal Core 2025-11-24 4.3 Medium
User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
CVE-2020-28949 5 Debian, Drupal, Fedoraproject and 2 more 6 Debian Linux, Drupal, Fedora and 3 more 2025-11-07 7.8 High
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
CVE-2020-36193 5 Debian, Drupal, Fedoraproject and 2 more 6 Debian Linux, Drupal, Fedora and 3 more 2025-11-07 7.5 High
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
CVE-2019-6340 1 Drupal 1 Drupal 2025-11-07 8.1 High
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)
CVE-2020-11023 8 Debian, Drupal, Fedoraproject and 5 more 78 Debian Linux, Drupal, Fedora and 75 more 2025-11-07 6.9 Medium
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2024-34481 2 Drupal, Kontextwork 2 Wiki, Drupal Wiki 2025-11-04 6.1 Medium
drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page.
CVE-2021-41184 7 Drupal, Fedoraproject, Jqueryui and 4 more 36 Drupal, Fedora, Jquery Ui and 33 more 2025-11-04 6.5 Medium
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.