drupal Vulnerabilities & CVE List (Nov 2026) | CyStack

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

drupal Vulnerabilities & CVE List (Nov 2026) | CyStack

CVE-2025-31676Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001

Exploitation status: Not exploited
Fix: Yes
Affected product: Email TFA
Published: 03/31/2025
Severity: High

CVE-2025-31675Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Exploitation status: Not exploited
Fix: Yes
Affected product: Drupal core
Published: 03/31/2025
Severity: Medium

CVE-2025-31674Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Exploitation status: Not exploited
Fix: Yes
Affected product: Drupal core
Published: 03/31/2025
Severity: High

CVE-2025-31673Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

Exploitation status: Not exploited
Fix: Yes
Affected product: Drupal core
Published: 03/31/2025
Severity: Medium

CVE-2025-3057Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

Exploitation status: Not exploited
Fix: Yes
Affected product: Drupal core
Published: 03/31/2025
Severity: Medium

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2025-31676`Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001	Exploitation statusNot exploited	FixYes

`CVE-2024-13301`Drupal OAuth/OIDC Client XSS in callback error rendering	Exploitation statusNot exploited	FixYes	Affected productOAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client)	Published01/09/2025	SeverityMedium

`CVE-2024-13281`Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045	Exploitation statusNot exploited	FixYes	Affected productMonster Menus	Published01/09/2025	SeverityCritical

`CVE-2024-13279`Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043	Exploitation statusNot exploited	FixYes	Affected productTwo-factor Authentication (TFA)	Published01/09/2025	SeverityCritical

`CVE-2024-13273`Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037	Exploitation statusNot exploited	FixYes	Affected productOpen Social	Published01/09/2025	SeverityMedium

`CVE-2024-13272`Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036	Exploitation statusNot exploited	FixYes	Affected productParagraphs table	Published01/09/2025	SeverityMedium

`CVE-2024-13261`Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025	Exploitation statusNot exploited	FixYes	Affected productAcquia DAM	Published01/09/2025	SeverityLow

`CVE-2024-13245`Cross-site scripting in Drupal CKEditor 4 LTS - WYSIWYG HTML editor	Exploitation statusNot exploited	FixYes	Affected productCKEditor 4 LTS - WYSIWYG HTML editor	Published01/09/2025	SeverityMedium

`CVE-2024-13239`Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003	Exploitation statusNot exploited	FixYes	Affected productTwo-factor Authentication (TFA)	Published01/09/2025	SeverityCritical