Filtered by vendor Drupal Subscriptions

Search

Switch to Advanced Search (Beta)
Total 1029 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-9281 4 Ckeditor, Drupal, Fedoraproject and 1 more 11 Ckeditor, Drupal, Fedora and 8 more 2026-08-25 6.1 Medium
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
CVE-2021-41164 4 Ckeditor, Drupal, Fedoraproject and 1 more 10 Ckeditor, Drupal, Fedora and 7 more 2026-08-25 8.2 High
CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
CVE-2025-8361 2 Config Pages Project, Drupal 2 Config Pages, Drupal 2026-08-10 7.6 High
Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing. This issue affects Config Pages: from 0.0.0 before 2.18.0.
CVE-2026-15086 1 Drupal 1 Raw Formatter [meta Tag Formatter] 2026-08-05 5.9 Medium
vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.
CVE-2026-10769 2 Centarro, Drupal 2 Commerce Core, Commerce Core 2026-07-15 5.4 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.
CVE-2026-11908 2 Drupal, Factorial 2 Tagify, Tagify 2026-07-15 5.4 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagify versions: from 0.0.0 to 1.2.52.
CVE-2026-10770 2 Cleantalk, Drupal 2 Anti-spam, Anti-spam By Cleantalk 2026-07-14 6.1 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.
CVE-2026-15087 1 Drupal 1 Clean Restful 2026-07-14 5.9 Medium
vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.
CVE-2026-11915 1 Drupal 1 Brute Force Attack Protection 2026-07-14 5.9 Medium
vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.
CVE-2026-11914 1 Drupal 1 Composer 2026-07-14 5.9 Medium
vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.
CVE-2026-11909 2 Drupal, Rfay 2 Examples For Developers, Examples For Developers 2026-07-13 3.3 Low
Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6.
CVE-2026-11913 1 Drupal 1 Mother May I 2026-07-13 9.8 Critical
vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.
CVE-2026-13237 2 Artificial Intelligence Project, Drupal 2 Artificial Intelligence, Ai Agents 2026-07-13 4.8 Medium
Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.
CVE-2026-13238 2 Drupal, Stella 2 Commerce Realex / Global Payments, Commerce Realex \/ Global Payments 2026-07-13 4.8 Medium
Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payments versions: from 0.0.0 to 3.0.2.
CVE-2026-58588 2 Drupal, Drupal Canvas Project 2 Drupal Canvas, Drupal Canvas 2026-07-13 6.1 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.
CVE-2026-58591 2 Colorbox Project, Drupal 2 Colorbox, Colorbox 2026-07-13 5.4 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.
CVE-2026-15082 2 Drupal, Ijsbrandy 2 Siteimprove Analytics, Siteimprove Analytics 2026-07-13 5.4 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.
CVE-2026-15083 2 Drupal, Jurgenhaas 2 Eca:event - Condition - Action, Eca\ 2026-07-13 4.2 Medium
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4.
CVE-2026-15084 2 Ademarco, Drupal 2 Ui Patterns, Ui Patterns (sdc In Drupal Ui) 2026-07-13 5.4 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.
CVE-2026-15085 2 Drupal, J-vee 2 Ai Seo/geo Analyzer, Ai Seo\/geo Analyzer 2026-07-13 5.4 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.