Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Drupal
HIGH 7.2
Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenam…
Drupal
MEDIUM 6.5
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data the…
Drupal
MEDIUM 6.1
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary…
Drupal
HIGH 7.5
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This co…
Drupal
HIGH 7.5
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating…
Drupal
MEDIUM 5.4
Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, r…
Drupal
HIGH 7.5
Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using …
Drupal
HIGH 7.5
Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request usi…
Saml Sp 2.0 Single Sign On
HIGH 8.8
Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An a…
Drupal
HIGH 8.1
Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that …
Drupal
HIGH 7.5
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak…
Drupal
HIGH 7.5
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plug…
Drupal
MEDIUM 5.4
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may …
Drupal
MEDIUM 6.5
The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" perm…
Drupal
HIGH 7.5
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This co…
Drupal
CRITICAL 9.8
Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which cause…
Drupal
HIGH 7.5
Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file…
Drupal
HIGH 7.5
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access…
Drupal
MEDIUM 6.5
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to p…
Drupal
MEDIUM 6.5
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are…
Drupal
MEDIUM 6.1
Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit th…
Drupal
MEDIUM 6.1
Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions pri…
Drupal
MEDIUM 6.1
Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances.…
Entity Embed
MEDIUM 6.1
The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivil…
Drupal
MEDIUM 5.4
CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may a…
Drupal
MEDIUM 5.4
CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module…
Drupal
HIGH 8.8
Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead…
Drupal
MEDIUM 6.1
Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to ex…
Drupal
MEDIUM 5.3
Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't…
Drupal
CRITICAL 9.8
Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under…