{"url":"http://public2.vulnerablecode.io/api/packages/156042?format=json","purl":"pkg:composer/drupal/core@8.0.6","type":"composer","namespace":"drupal","name":"core","version":"8.0.6","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"10.4.9","latest_non_vulnerable_version":"11.2.8","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10221?format=json","vulnerability_id":"VCID-1922-fwnz-wkbt","summary":"Improper Privilege Management\nWhen using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6924","reference_id":"","reference_type":"","scores":[{"value":"0.00488","scoring_system":"epss","scoring_elements":"0.65375","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00488","scoring_system":"epss","scoring_elements":"0.65457","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00488","scoring_system":"epss","scoring_elements":"0.65484","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00488","scoring_system":"epss","scoring_elements":"0.65498","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00488","scoring_system":"epss","scoring_elements":"0.65479","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00488","scoring_system":"epss","scoring_elements":"0.65468","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00488","scoring_system":"epss","scoring_elements":"0.65415","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00488","scoring_system":"epss","scoring_elements":"0.65451","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00488","scoring_system":"epss","scoring_elements":"0.65424","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6924"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6924.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6924.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6924.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6924.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6924","reference_id":"","reference_type":"","scores":[{"value":"5.8","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:P/I:P/A:N"},{"value":"7.4","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6924"},{"reference_url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple"},{"reference_url":"https://www.drupal.org/SA-CORE-2017-004","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2017-004"},{"reference_url":"http://www.securityfocus.com/bid/100368","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/100368"},{"reference_url":"http://www.securitytracker.com/id/1039200","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securitytracker.com/id/1039200"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://github.com/advisories/GHSA-p8g6-5mg7-9r5q","reference_id":"GHSA-p8g6-5mg7-9r5q","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p8g6-5mg7-9r5q"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/34584?format=json","purl":"pkg:composer/drupal/core@8.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.3.0"},{"url":"http://public2.vulnerablecode.io/api/packages/34582?format=json","purl":"pkg:composer/drupal/core@8.3.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-yare-57j9-j7cs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.3.7"}],"aliases":["CVE-2017-6924","GHSA-p8g6-5mg7-9r5q"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1922-fwnz-wkbt"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10639?format=json","vulnerability_id":"VCID-349d-w26k-mqfw","summary":"Moderately critical - Third-party libraries - SA-CORE-2019-007\nThe `PharStreamWrapper` (aka `phar-stream-wrapper`) package does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a `phar:///path/bad.phar/../good.phar` URL.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11831","reference_id":"","reference_type":"","scores":[{"value":"0.09656","scoring_system":"epss","scoring_elements":"0.92901","published_at":"2026-04-13T12:55:00Z"},{"value":"0.09656","scoring_system":"epss","scoring_elements":"0.929","published_at":"2026-04-12T12:55:00Z"},{"value":"0.09656","scoring_system":"epss","scoring_elements":"0.92902","published_at":"2026-04-11T12:55:00Z"},{"value":"0.09656","scoring_system":"epss","scoring_elements":"0.92897","published_at":"2026-04-09T12:55:00Z"},{"value":"0.10327","scoring_system":"epss","scoring_elements":"0.93164","published_at":"2026-04-02T12:55:00Z"},{"value":"0.10327","scoring_system":"epss","scoring_elements":"0.93155","published_at":"2026-04-01T12:55:00Z"},{"value":"0.10327","scoring_system":"epss","scoring_elements":"0.93175","published_at":"2026-04-08T12:55:00Z"},{"value":"0.10327","scoring_system":"epss","scoring_elements":"0.93167","published_at":"2026-04-07T12:55:00Z"},{"value":"0.10327","scoring_system":"epss","scoring_elements":"0.93168","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11831"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11831","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11831"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-11831.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-11831.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-11831.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-11831.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/phar-stream-wrapper/CVE-2019-11831.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/phar-stream-wrapper/CVE-2019-11831.yaml"},{"reference_url":"https://github.com/TYPO3/phar-stream-wrapper","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/TYPO3/phar-stream-wrapper"},{"reference_url":"https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v2.1.1","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v2.1.1"},{"reference_url":"https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v3.1.1","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v3.1.1"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4/"},{"reference_url":"https://seclists.org/bugtraq/2019/May/36","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://seclists.org/bugtraq/2019/May/36"},{"reference_url":"https://typo3.org/security/advisory/typo3-psa-2019-007","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://typo3.org/security/advisory/typo3-psa-2019-007"},{"reference_url":"https://typo3.org/security/advisory/typo3-psa-2019-007/","reference_id":"","reference_type":"","scores":[],"url":"https://typo3.org/security/advisory/typo3-psa-2019-007/"},{"reference_url":"https://www.debian.org/security/2019/dsa-4445","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2019/dsa-4445"},{"reference_url":"https://www.drupal.org/sa-core-2019-007","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-007"},{"reference_url":"https://www.drupal.org/SA-CORE-2019-007","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2019-007"},{"reference_url":"https://www.synology.com/security/advisory/Synology_SA_19_22","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.synology.com/security/advisory/Synology_SA_19_22"},{"reference_url":"http://www.securityfocus.com/bid/108302","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/108302"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11831","reference_id":"CVE-2019-11831","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11831"},{"reference_url":"https://github.com/advisories/GHSA-xv7v-rf6g-xwrc","reference_id":"GHSA-xv7v-rf6g-xwrc","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xv7v-rf6g-xwrc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/36443?format=json","purl":"pkg:composer/drupal/core@8.6.16","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.16"},{"url":"http://public2.vulnerablecode.io/api/packages/36444?format=json","purl":"pkg:composer/drupal/core@8.7.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.7.1"}],"aliases":["CVE-2019-11831","GHSA-xv7v-rf6g-xwrc"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-349d-w26k-mqfw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7504?format=json","vulnerability_id":"VCID-381m-cmnk-ykef","summary":"Information Exposure\nThe Views module in Drupal and the Views module might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-6212","reference_id":"","reference_type":"","scores":[{"value":"0.00537","scoring_system":"epss","scoring_elements":"0.67474","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00537","scoring_system":"epss","scoring_elements":"0.67515","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00537","scoring_system":"epss","scoring_elements":"0.67548","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00537","scoring_system":"epss","scoring_elements":"0.67561","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00537","scoring_system":"epss","scoring_elements":"0.67539","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00537","scoring_system":"epss","scoring_elements":"0.67525","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00537","scoring_system":"epss","scoring_elements":"0.67473","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00537","scoring_system":"epss","scoring_elements":"0.67495","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00537","scoring_system":"epss","scoring_elements":"0.67438","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-6212"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-6212.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-6212.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-6212.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-6212.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6212","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6212"},{"reference_url":"https://www.drupal.org/node/2749333","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/node/2749333"},{"reference_url":"https://www.drupal.org/SA-CORE-2016-002","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2016-002"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/07/13/4","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2016/07/13/4"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/07/13/7","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2016/07/13/7"},{"reference_url":"http://www.securityfocus.com/bid/91230","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/91230"},{"reference_url":"https://github.com/advisories/GHSA-rfxx-gxwc-923c","reference_id":"GHSA-rfxx-gxwc-923c","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rfxx-gxwc-923c"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22707?format=json","purl":"pkg:composer/drupal/core@8.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-4wwt-vt76-dbe1"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-d4qd-ut89-gbf4"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hpsp-5qtj-v7dq"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-m1ur-bb9m-m7d5"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-sktb-khbq-cuaq"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-vy1y-zkf3-4ue4"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"},{"vulnerability":"VCID-yrzt-3m97-53ce"},{"vulnerability":"VCID-yty5-zn46-r3dj"},{"vulnerability":"VCID-zvtp-4we3-qygx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.1.0"},{"url":"http://public2.vulnerablecode.io/api/packages/81770?format=json","purl":"pkg:composer/drupal/core@8.1.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-4wwt-vt76-dbe1"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-d4qd-ut89-gbf4"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hpsp-5qtj-v7dq"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-m1ur-bb9m-m7d5"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-sktb-khbq-cuaq"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-vy1y-zkf3-4ue4"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"},{"vulnerability":"VCID-yrzt-3m97-53ce"},{"vulnerability":"VCID-yty5-zn46-r3dj"},{"vulnerability":"VCID-zvtp-4we3-qygx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.1.3"}],"aliases":["CVE-2016-6212","GHSA-rfxx-gxwc-923c"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-381m-cmnk-ykef"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10233?format=json","vulnerability_id":"VCID-3fka-y25d-m7a3","summary":"Improper Input Validation\nA remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted `phar://` URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability. This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6339","reference_id":"","reference_type":"","scores":[{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.98913","published_at":"2026-04-02T12:55:00Z"},{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.98921","published_at":"2026-04-13T12:55:00Z"},{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.9892","published_at":"2026-04-11T12:55:00Z"},{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.98918","published_at":"2026-04-09T12:55:00Z"},{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.98919","published_at":"2026-04-08T12:55:00Z"},{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.98917","published_at":"2026-04-07T12:55:00Z"},{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.98912","published_at":"2026-04-01T12:55:00Z"},{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.98915","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6339"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6338","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6338"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6339","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6339"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6339.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6339.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6339.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6339.yaml"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00004.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00004.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6339","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},{"value":"9.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6339"},{"reference_url":"https://www.debian.org/security/2019/dsa-4370","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2019/dsa-4370"},{"reference_url":"https://www.drupal.org/sa-core-2019-002","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-002"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"},{"reference_url":"https://github.com/advisories/GHSA-8cw5-rv98-5c46","reference_id":"GHSA-8cw5-rv98-5c46","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8cw5-rv98-5c46"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/80248?format=json","purl":"pkg:composer/drupal/core@8.5.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.5.9"},{"url":"http://public2.vulnerablecode.io/api/packages/34662?format=json","purl":"pkg:composer/drupal/core@8.6.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.6"}],"aliases":["CVE-2019-6339","GHSA-8cw5-rv98-5c46"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3fka-y25d-m7a3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10242?format=json","vulnerability_id":"VCID-3hf4-tvxn-zyh4","summary":"Files uploaded by anonymous users accessed by other users\nPrivate files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core does not provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6922","reference_id":"","reference_type":"","scores":[{"value":"0.01788","scoring_system":"epss","scoring_elements":"0.82674","published_at":"2026-04-01T12:55:00Z"},{"value":"0.01788","scoring_system":"epss","scoring_elements":"0.8274","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01788","scoring_system":"epss","scoring_elements":"0.82744","published_at":"2026-04-12T12:55:00Z"},{"value":"0.01788","scoring_system":"epss","scoring_elements":"0.82749","published_at":"2026-04-11T12:55:00Z"},{"value":"0.01788","scoring_system":"epss","scoring_elements":"0.82732","published_at":"2026-04-09T12:55:00Z"},{"value":"0.01788","scoring_system":"epss","scoring_elements":"0.82726","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01788","scoring_system":"epss","scoring_elements":"0.827","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01788","scoring_system":"epss","scoring_elements":"0.82704","published_at":"2026-04-04T12:55:00Z"},{"value":"0.01788","scoring_system":"epss","scoring_elements":"0.8269","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6922"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6922","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6922"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6922.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6922.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6922.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6922.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6922","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:S/C:P/I:N/A:N"},{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6922"},{"reference_url":"https://www.debian.org/security/2017/dsa-3897","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2017/dsa-3897"},{"reference_url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple"},{"reference_url":"https://www.drupal.org/SA-CORE-2017-003","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2017-003"},{"reference_url":"http://www.securityfocus.com/bid/99219","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/99219"},{"reference_url":"http://www.securitytracker.com/id/1038781","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securitytracker.com/id/1038781"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"},{"reference_url":"https://github.com/advisories/GHSA-58f3-cx8p-h8jg","reference_id":"GHSA-58f3-cx8p-h8jg","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-58f3-cx8p-h8jg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/29924?format=json","purl":"pkg:composer/drupal/core@8.3.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-yare-57j9-j7cs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.3.4"}],"aliases":["CVE-2017-6922","GHSA-58f3-cx8p-h8jg"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3hf4-tvxn-zyh4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19472?format=json","vulnerability_id":"VCID-3sr6-86jw-6fb9","summary":"Drupal External URL injection through URL aliases leading to Open Redirect\nThe path module in Drupal allows users with the 'administer paths' to create pretty URLs for content.\nIn certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url.","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2018-10-17-2.yaml","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2018-10-17-2.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-006"},{"reference_url":"https://github.com/advisories/GHSA-7f4f-p7mq-p4fv","reference_id":"GHSA-7f4f-p7mq-p4fv","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7f4f-p7mq-p4fv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60240?format=json","purl":"pkg:composer/drupal/core@8.5.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.5.8"},{"url":"http://public2.vulnerablecode.io/api/packages/32218?format=json","purl":"pkg:composer/drupal/core@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.2"}],"aliases":["GHSA-7f4f-p7mq-p4fv"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3sr6-86jw-6fb9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8826?format=json","vulnerability_id":"VCID-48ut-ykkc-83fx","summary":"Comment reply form allows access to restricted content\nUsers with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the attacker must have permission to post comments.","references":[{"reference_url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6926","reference_id":"","reference_type":"","scores":[],"url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6926"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6926","reference_id":"","reference_type":"","scores":[{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58547","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58437","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58522","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58542","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58512","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58564","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58571","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58587","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58567","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6926"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6926.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6926.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6926.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6926.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6926","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6926"},{"reference_url":"https://www.drupal.org/sa-core-2018-001","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-001"},{"reference_url":"https://www.drupal.org/SA-CORE-2018-001","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2018-001"},{"reference_url":"https://github.com/advisories/GHSA-2p28-5mvp-2j2r","reference_id":"GHSA-2p28-5mvp-2j2r","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2p28-5mvp-2j2r"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26566?format=json","purl":"pkg:composer/drupal/core@8.4.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.4.5"}],"aliases":["CVE-2017-6926","GHSA-2p28-5mvp-2j2r"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-48ut-ykkc-83fx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8983?format=json","vulnerability_id":"VCID-4aer-46u2-23f6","summary":"Cross-site Scripting\nCross-site scripting (XSS) vulnerability in the Enhanced Image plugin for CKEditor.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-9861","reference_id":"","reference_type":"","scores":[{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.5884","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58802","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58821","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58698","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58772","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58794","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58763","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58815","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58822","published_at":"2026-04-09T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-9861"},{"reference_url":"https://github.com/ckeditor/ckeditor-dev/blob/master/CHANGES.md","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ckeditor/ckeditor-dev/blob/master/CHANGES.md"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-9861.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-9861.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-9861.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-9861.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2018-003","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-003"},{"reference_url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"},{"reference_url":"http://www.securityfocus.com/bid/103924","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/103924"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ckeditor:enhanced_image:*:*:*:*:*:ckeditor:*:*","reference_id":"cpe:2.3:a:ckeditor:enhanced_image:*:*:*:*:*:ckeditor:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ckeditor:enhanced_image:*:*:*:*:*:ckeditor:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9861","reference_id":"CVE-2018-9861","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:N/I:P/A:N"},{"value":"6.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9861"},{"reference_url":"https://github.com/advisories/GHSA-g78h-pf65-46rv","reference_id":"GHSA-g78h-pf65-46rv","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-g78h-pf65-46rv"},{"reference_url":"https://usn.ubuntu.com/5340-1/","reference_id":"USN-5340-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5340-1/"},{"reference_url":"https://usn.ubuntu.com/USN-5340-2/","reference_id":"USN-USN-5340-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/USN-5340-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/27004?format=json","purl":"pkg:composer/drupal/core@8.4.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.4.7"},{"url":"http://public2.vulnerablecode.io/api/packages/27006?format=json","purl":"pkg:composer/drupal/core@8.5.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.5.2"}],"aliases":["CVE-2018-9861","GHSA-g78h-pf65-46rv"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4aer-46u2-23f6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7519?format=json","vulnerability_id":"VCID-4wwt-vt76-dbe1","summary":"Cross-site Scripting in HTTP exceptions\nAn attacker can create a specially crafted url, which can execute arbitrary code in the victim’s browser if loaded. Drupal is not properly sanitizing an exception.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7571","reference_id":"","reference_type":"","scores":[{"value":"0.0039","scoring_system":"epss","scoring_elements":"0.6002","published_at":"2026-04-02T12:55:00Z"},{"value":"0.0039","scoring_system":"epss","scoring_elements":"0.60045","published_at":"2026-04-04T12:55:00Z"},{"value":"0.0039","scoring_system":"epss","scoring_elements":"0.59943","published_at":"2026-04-01T12:55:00Z"},{"value":"0.0039","scoring_system":"epss","scoring_elements":"0.60068","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0039","scoring_system":"epss","scoring_elements":"0.60085","published_at":"2026-04-12T12:55:00Z"},{"value":"0.0039","scoring_system":"epss","scoring_elements":"0.601","published_at":"2026-04-11T12:55:00Z"},{"value":"0.0039","scoring_system":"epss","scoring_elements":"0.60079","published_at":"2026-04-09T12:55:00Z"},{"value":"0.0039","scoring_system":"epss","scoring_elements":"0.60065","published_at":"2026-04-08T12:55:00Z"},{"value":"0.0039","scoring_system":"epss","scoring_elements":"0.60015","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7571"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7571.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7571.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7571.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7571.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7571","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7571"},{"reference_url":"https://www.drupal.org/SA-CORE-2016-004","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2016-004"},{"reference_url":"http://www.securityfocus.com/bid/93101","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/93101"},{"reference_url":"http://www.securitytracker.com/id/1036886","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securitytracker.com/id/1036886"},{"reference_url":"https://github.com/advisories/GHSA-vhg8-x858-7wq6","reference_id":"GHSA-vhg8-x858-7wq6","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vhg8-x858-7wq6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23184?format=json","purl":"pkg:composer/drupal/core@8.1.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-d4qd-ut89-gbf4"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hpsp-5qtj-v7dq"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-m1ur-bb9m-m7d5"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-sktb-khbq-cuaq"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-vy1y-zkf3-4ue4"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"},{"vulnerability":"VCID-yrzt-3m97-53ce"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.1.10"}],"aliases":["CVE-2016-7571","GHSA-vhg8-x858-7wq6"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4wwt-vt76-dbe1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10460?format=json","vulnerability_id":"VCID-565p-mgqe-gkfc","summary":"Cross-site Scripting vulnerability in drupal.","references":[{"reference_url":"https://www.drupal.org/sa-core-2019-004","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2019-004"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/35386?format=json","purl":"pkg:composer/drupal/core@8.6.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.12"}],"aliases":["2019-03-20"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-565p-mgqe-gkfc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19035?format=json","vulnerability_id":"VCID-5kh7-v1uc-wfha","summary":"Drupal core unrestricted file upload\nDrupal 8 core's file_save_upload() function does not strip the leading and trailing dot ('.') from filenames, like Drupal 7 did.\n\nUsers with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to bypass protections afforded by Drupal's default .htaccess file.\n\nAfter this fix, file_save_upload() now trims leading and trailing dots from filenames.","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2019-12-18-2.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2019-12-18-2.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2019-010","reference_id":"","reference_type":"","scores":[{"value":"6.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-010"},{"reference_url":"https://github.com/advisories/GHSA-7gwj-7fhm-vw4w","reference_id":"GHSA-7gwj-7fhm-vw4w","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7gwj-7fhm-vw4w"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59955?format=json","purl":"pkg:composer/drupal/core@8.7.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.7.11"},{"url":"http://public2.vulnerablecode.io/api/packages/59956?format=json","purl":"pkg:composer/drupal/core@8.8.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9qyz-jfgb-5yfs"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-agtf-c53h-2fdx"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-mhk6-9qdy-83f3"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-ptxz-rvbt-hqhz"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-rxhd-nkpr-87fm"},{"vulnerability":"VCID-ssyn-dxp9-3kdq"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.1"}],"aliases":["GHSA-7gwj-7fhm-vw4w"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5kh7-v1uc-wfha"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10652?format=json","vulnerability_id":"VCID-636u-5bdw-puh4","summary":"Cross-site Scripting\nIn Symfony, validation messages are not escaped, which can lead to XSS when user input is included.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-10909","reference_id":"","reference_type":"","scores":[{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58747","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58776","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58814","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58795","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58788","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58736","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58768","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58663","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-10909"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14773","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14773"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19789","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19789"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19790","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19790"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10909","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10909"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10910","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10910"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10911","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10911"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10912","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10912"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10913","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10913"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml"},{"reference_url":"https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2"},{"reference_url":"https://www.drupal.org/sa-core-2019-005","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-005"},{"reference_url":"https://www.synology.com/security/advisory/Synology_SA_19_19","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.synology.com/security/advisory/Synology_SA_19_19"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10909","reference_id":"CVE-2019-10909","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10909"},{"reference_url":"https://symfony.com/cve-2019-10909","reference_id":"CVE-2019-10909","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://symfony.com/cve-2019-10909"},{"reference_url":"https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine","reference_id":"CVE-2019-10909-ESCAPE-VALIDATION-MESSAGES-IN-THE-PHP-TEMPLATING-ENGINE","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine"},{"reference_url":"https://github.com/advisories/GHSA-g996-q5r8-w7g2","reference_id":"GHSA-g996-q5r8-w7g2","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-g996-q5r8-w7g2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/36161?format=json","purl":"pkg:composer/drupal/core@8.5.15","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.5.15"},{"url":"http://public2.vulnerablecode.io/api/packages/36163?format=json","purl":"pkg:composer/drupal/core@8.6.15","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.15"}],"aliases":["CVE-2019-10909","GHSA-g996-q5r8-w7g2"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-636u-5bdw-puh4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/17391?format=json","vulnerability_id":"VCID-6ck5-9e5b-w3ay","summary":"Improper access control\nIn some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the \"private\" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing files or image styles after updating.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25275","reference_id":"","reference_type":"","scores":[{"value":"0.00375","scoring_system":"epss","scoring_elements":"0.59084","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00375","scoring_system":"epss","scoring_elements":"0.59071","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00375","scoring_system":"epss","scoring_elements":"0.59107","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00375","scoring_system":"epss","scoring_elements":"0.59144","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00375","scoring_system":"epss","scoring_elements":"0.59126","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00375","scoring_system":"epss","scoring_elements":"0.59123","published_at":"2026-04-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25275"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/2d5f47fc8a166115f56c2330a81e83abe22445cf","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/2d5f47fc8a166115f56c2330a81e83abe22445cf"},{"reference_url":"https://github.com/drupal/core/commit/e2fbf63700819cb470a1be425798f1a3f2020116","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/e2fbf63700819cb470a1be425798f1a3f2020116"},{"reference_url":"https://www.drupal.org/sa-core-2022-012","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-03T18:45:46Z/"}],"url":"https://www.drupal.org/sa-core-2022-012"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25275","reference_id":"CVE-2022-25275","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25275"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25275.yaml","reference_id":"CVE-2022-25275.YAML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25275.yaml"},{"reference_url":"https://github.com/advisories/GHSA-xh3v-6f9j-wxw3","reference_id":"GHSA-xh3v-6f9j-wxw3","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xh3v-6f9j-wxw3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57343?format=json","purl":"pkg:composer/drupal/core@9.3.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.19"},{"url":"http://public2.vulnerablecode.io/api/packages/57345?format=json","purl":"pkg:composer/drupal/core@9.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.4.3"}],"aliases":["CVE-2022-25275","GHSA-xh3v-6f9j-wxw3","GMS-2022-3362"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6ck5-9e5b-w3ay"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/11348?format=json","vulnerability_id":"VCID-6m8x-cfzp-tkf4","summary":"Drupal core Unrestricted Upload of File with Dangerous Type\nDrupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13671","reference_id":"","reference_type":"","scores":[{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89078","published_at":"2026-04-01T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89133","published_at":"2026-04-13T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89135","published_at":"2026-04-12T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89138","published_at":"2026-04-11T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89127","published_at":"2026-04-09T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89122","published_at":"2026-04-08T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89105","published_at":"2026-04-07T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89102","published_at":"2026-04-04T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89087","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13671"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT"},{"reference_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13671","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13671"},{"reference_url":"https://www.drupal.org/sa-core-2020-012","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:31Z/"}],"url":"https://www.drupal.org/sa-core-2020-012"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/","reference_id":"5KSFM672XW3X6BR7TVKRD63SLZGKK437","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:31Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13671","reference_id":"CVE-2020-13671","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13671"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13671.yaml","reference_id":"CVE-2020-13671.YAML","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13671.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13671.yaml","reference_id":"CVE-2020-13671.YAML","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13671.yaml"},{"reference_url":"https://github.com/advisories/GHSA-68jc-v27h-vhmw","reference_id":"GHSA-68jc-v27h-vhmw","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-68jc-v27h-vhmw"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/","reference_id":"KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:31Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/"},{"reference_url":"https://usn.ubuntu.com/6981-1/","reference_id":"USN-6981-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6981-1/"},{"reference_url":"https://usn.ubuntu.com/6981-2/","reference_id":"USN-6981-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6981-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/40895?format=json","purl":"pkg:composer/drupal/core@8.8.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.11"},{"url":"http://public2.vulnerablecode.io/api/packages/40893?format=json","purl":"pkg:composer/drupal/core@8.9.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.9"},{"url":"http://public2.vulnerablecode.io/api/packages/40891?format=json","purl":"pkg:composer/drupal/core@9.0.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.8"}],"aliases":["CVE-2020-13671","GHSA-68jc-v27h-vhmw"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6m8x-cfzp-tkf4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12888?format=json","vulnerability_id":"VCID-77zc-1gc8-r7b7","summary":"Unrestricted Upload of File with Dangerous Type\nDrupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13675","reference_id":"","reference_type":"","scores":[{"value":"0.00797","scoring_system":"epss","scoring_elements":"0.73981","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00797","scoring_system":"epss","scoring_elements":"0.73955","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00797","scoring_system":"epss","scoring_elements":"0.73951","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00797","scoring_system":"epss","scoring_elements":"0.73996","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00797","scoring_system":"epss","scoring_elements":"0.74003","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00797","scoring_system":"epss","scoring_elements":"0.74021","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00797","scoring_system":"epss","scoring_elements":"0.73999","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00797","scoring_system":"epss","scoring_elements":"0.73948","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00797","scoring_system":"epss","scoring_elements":"0.73986","published_at":"2026-04-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13675"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2021-008","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2021-008"},{"reference_url":"https://security.archlinux.org/AVG-2407","reference_id":"AVG-2407","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-2407"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13675","reference_id":"CVE-2020-13675","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13675"},{"reference_url":"https://github.com/advisories/GHSA-v8wr-r69p-mmwx","reference_id":"GHSA-v8wr-r69p-mmwx","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v8wr-r69p-mmwx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46155?format=json","purl":"pkg:composer/drupal/core@8.9.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.19"},{"url":"http://public2.vulnerablecode.io/api/packages/46118?format=json","purl":"pkg:composer/drupal/core@9.1.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.13"},{"url":"http://public2.vulnerablecode.io/api/packages/46119?format=json","purl":"pkg:composer/drupal/core@9.2.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-674z-nf4t-b7ez"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-b4yh-gyrx-3yhh"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-zw3u-6ue7-efdf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.2.6"}],"aliases":["CVE-2020-13675","GHSA-v8wr-r69p-mmwx"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-77zc-1gc8-r7b7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19417?format=json","vulnerability_id":"VCID-7fs3-gwc7-nkes","summary":"Drupal core Denial of Service\nA visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt.","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2019-12-18-1.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2019-12-18-1.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2019-009","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-009"},{"reference_url":"https://github.com/advisories/GHSA-pr99-c33p-fwf6","reference_id":"GHSA-pr99-c33p-fwf6","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-pr99-c33p-fwf6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59955?format=json","purl":"pkg:composer/drupal/core@8.7.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.7.11"},{"url":"http://public2.vulnerablecode.io/api/packages/59956?format=json","purl":"pkg:composer/drupal/core@8.8.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9qyz-jfgb-5yfs"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-agtf-c53h-2fdx"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-mhk6-9qdy-83f3"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-ptxz-rvbt-hqhz"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-rxhd-nkpr-87fm"},{"vulnerability":"VCID-ssyn-dxp9-3kdq"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.1"}],"aliases":["GHSA-pr99-c33p-fwf6"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-7fs3-gwc7-nkes"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8827?format=json","vulnerability_id":"VCID-9f24-vqyt-r7dq","summary":"Language fallback can be incorrect on multilingual sites with node access restrictions\nWhen using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records(). Note that the update will mark the node access tables as needing a rebuild, which will take a long time on sites with a large number of nodes.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6930","reference_id":"","reference_type":"","scores":[{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.6218","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62065","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62125","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62156","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62126","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62176","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62194","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62211","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62201","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6930"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6930.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6930.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6930.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6930.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6930","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6930"},{"reference_url":"https://www.drupal.org/sa-core-2018-001","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-001"},{"reference_url":"https://www.drupal.org/SA-CORE-2018-001","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2018-001"},{"reference_url":"http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6930","reference_id":"","reference_type":"","scores":[],"url":"http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6930"},{"reference_url":"https://github.com/advisories/GHSA-3327-jr93-7hq3","reference_id":"GHSA-3327-jr93-7hq3","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3327-jr93-7hq3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26566?format=json","purl":"pkg:composer/drupal/core@8.4.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.4.5"}],"aliases":["CVE-2017-6930","GHSA-3327-jr93-7hq3"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9f24-vqyt-r7dq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19530?format=json","vulnerability_id":"VCID-9ss3-mvt3-8bem","summary":"Drupal core Arbitrary PHP code execution\nThe Drupal project uses the PEAR Archive_Tar library. The PEAR Archive_Tar library has released a security update that impacts Drupal. For more information please see:\nCVE-2020-28948\nCVE-2020-28949\n\nMultiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them.\n\nTo mitigate this issue, prevent untrusted users from uploading .tar, .tar.gz, .bz2, or .tlz files.","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2020-11-25.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2020-11-25.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2020-013","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-013"},{"reference_url":"https://github.com/advisories/GHSA-gxxj-g9v8-w28p","reference_id":"GHSA-gxxj-g9v8-w28p","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gxxj-g9v8-w28p"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60690?format=json","purl":"pkg:composer/drupal/core@8.8.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.12"},{"url":"http://public2.vulnerablecode.io/api/packages/60691?format=json","purl":"pkg:composer/drupal/core@8.9.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.10"},{"url":"http://public2.vulnerablecode.io/api/packages/60692?format=json","purl":"pkg:composer/drupal/core@9.0.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.9"}],"aliases":["GHSA-gxxj-g9v8-w28p"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9ss3-mvt3-8bem"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8967?format=json","vulnerability_id":"VCID-9vdz-1jpq-kue3","summary":"Cross-site Scripting\nXSS vulnerabiltiy in drupal.","references":[{"reference_url":"https://www.drupal.org/sa-core-2018-003","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2018-003"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/27004?format=json","purl":"pkg:composer/drupal/core@8.4.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.4.7"},{"url":"http://public2.vulnerablecode.io/api/packages/168771?format=json","purl":"pkg:composer/drupal/core@8.5.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.5.0-alpha1"},{"url":"http://public2.vulnerablecode.io/api/packages/27006?format=json","purl":"pkg:composer/drupal/core@8.5.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.5.2"}],"aliases":["2018-04-18"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9vdz-1jpq-kue3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/17402?format=json","vulnerability_id":"VCID-bbzr-hbhv-yyee","summary":"Improper Input Validation\nDrupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25273","reference_id":"","reference_type":"","scores":[{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51563","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51586","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51603","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51577","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51523","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51624","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51574","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51536","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25273"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2022-008","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-03T19:19:11Z/"}],"url":"https://www.drupal.org/sa-core-2022-008"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25273","reference_id":"CVE-2022-25273","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25273"},{"reference_url":"https://github.com/advisories/GHSA-g36h-4jr6-qmm9","reference_id":"GHSA-g36h-4jr6-qmm9","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-g36h-4jr6-qmm9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57373?format=json","purl":"pkg:composer/drupal/core@9.2.18","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-674z-nf4t-b7ez"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.2.18"},{"url":"http://public2.vulnerablecode.io/api/packages/57374?format=json","purl":"pkg:composer/drupal/core@9.3.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-674z-nf4t-b7ez"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.12"}],"aliases":["CVE-2022-25273","GHSA-g36h-4jr6-qmm9"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bbzr-hbhv-yyee"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12886?format=json","vulnerability_id":"VCID-bkxp-gn34-67av","summary":"Cross-Site Request Forgery (CSRF)\nThe QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the \"access in-place editing\" permission from untrusted users will not fully mitigate the vulnerability.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13674","reference_id":"","reference_type":"","scores":[{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.33968","published_at":"2026-04-01T12:55:00Z"},{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.34208","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.34231","published_at":"2026-04-12T12:55:00Z"},{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.34273","published_at":"2026-04-11T12:55:00Z"},{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.34272","published_at":"2026-04-09T12:55:00Z"},{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.34243","published_at":"2026-04-08T12:55:00Z"},{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.342","published_at":"2026-04-07T12:55:00Z"},{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.34336","published_at":"2026-04-04T12:55:00Z"},{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.34307","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13674"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/20cd85db8198c63101bd050ea973b13f2f3edef6","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/20cd85db8198c63101bd050ea973b13f2f3edef6"},{"reference_url":"https://github.com/drupal/core/commit/6359b3ea5aacf85399285c522c6d787a218c897c","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/6359b3ea5aacf85399285c522c6d787a218c897c"},{"reference_url":"https://github.com/drupal/core/commit/801910fcdfc14ee6120051089a2129e455186ad8","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/801910fcdfc14ee6120051089a2129e455186ad8"},{"reference_url":"https://www.drupal.org/sa-core-2021-007","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2021-007"},{"reference_url":"https://security.archlinux.org/AVG-2407","reference_id":"AVG-2407","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-2407"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13674","reference_id":"CVE-2020-13674","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13674"},{"reference_url":"https://github.com/advisories/GHSA-j586-cj67-vg4p","reference_id":"GHSA-j586-cj67-vg4p","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-j586-cj67-vg4p"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46155?format=json","purl":"pkg:composer/drupal/core@8.9.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.19"},{"url":"http://public2.vulnerablecode.io/api/packages/46118?format=json","purl":"pkg:composer/drupal/core@9.1.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.13"},{"url":"http://public2.vulnerablecode.io/api/packages/46119?format=json","purl":"pkg:composer/drupal/core@9.2.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-674z-nf4t-b7ez"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-b4yh-gyrx-3yhh"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-zw3u-6ue7-efdf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.2.6"}],"aliases":["CVE-2020-13674","GHSA-j586-cj67-vg4p"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bkxp-gn34-67av"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9962?format=json","vulnerability_id":"VCID-c9dm-17vt-4bbc","summary":"Improper Access Control in drupal.","references":[{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2018-006"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/32218?format=json","purl":"pkg:composer/drupal/core@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.2"}],"aliases":["2018-10-17-1"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-c9dm-17vt-4bbc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10229?format=json","vulnerability_id":"VCID-cucx-jfqf-pkd1","summary":"Deserialization of Untrusted Data\nDrupal core uses the third-party PEAR `Archive_Tar` library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6338","reference_id":"","reference_type":"","scores":[{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.77449","published_at":"2026-04-01T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.77504","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.77507","published_at":"2026-04-12T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.77526","published_at":"2026-04-11T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.775","published_at":"2026-04-09T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.77491","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.77461","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.7748","published_at":"2026-04-04T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.77455","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6338"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6338","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6338"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6339","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6339"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6338.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6338.yaml"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00032.html","reference_id":"","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00032.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6338","reference_id":"","reference_type":"","scores":[{"value":"6.0","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:S/C:P/I:P/A:P"},{"value":"8.0","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6338"},{"reference_url":"https://www.debian.org/security/2019/dsa-4370","reference_id":"","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2019/dsa-4370"},{"reference_url":"https://www.drupal.org/sa-core-2019-001","reference_id":"","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-001"},{"reference_url":"http://www.securityfocus.com/bid/106706","reference_id":"","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/106706"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"},{"reference_url":"https://github.com/advisories/GHSA-6rmq-x2hv-vxpp","reference_id":"GHSA-6rmq-x2hv-vxpp","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6rmq-x2hv-vxpp"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/34662?format=json","purl":"pkg:composer/drupal/core@8.6.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.6"}],"aliases":["CVE-2019-6338","GHSA-6rmq-x2hv-vxpp"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cucx-jfqf-pkd1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8832?format=json","vulnerability_id":"VCID-cuk6-hskr-yyau","summary":"Settings Tray access bypass\nIn Drupal, the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6931","reference_id":"","reference_type":"","scores":[{"value":"0.00179","scoring_system":"epss","scoring_elements":"0.39534","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00179","scoring_system":"epss","scoring_elements":"0.39406","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00179","scoring_system":"epss","scoring_elements":"0.39568","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00179","scoring_system":"epss","scoring_elements":"0.39592","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00179","scoring_system":"epss","scoring_elements":"0.39507","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00179","scoring_system":"epss","scoring_elements":"0.39562","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00179","scoring_system":"epss","scoring_elements":"0.39578","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00179","scoring_system":"epss","scoring_elements":"0.39588","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00179","scoring_system":"epss","scoring_elements":"0.3955","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6931"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6931","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6931"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6931.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6931.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6931.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6931.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2018-001","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-001"},{"reference_url":"https://www.drupal.org/SA-CORE-2018-001","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2018-001"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6931","reference_id":"CVE-2017-6931","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6931"},{"reference_url":"https://github.com/advisories/GHSA-7ffh-cjvg-fpr4","reference_id":"GHSA-7ffh-cjvg-fpr4","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7ffh-cjvg-fpr4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26566?format=json","purl":"pkg:composer/drupal/core@8.4.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.4.5"}],"aliases":["CVE-2017-6931","GHSA-7ffh-cjvg-fpr4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cuk6-hskr-yyau"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7849?format=json","vulnerability_id":"VCID-d4qd-ut89-gbf4","summary":"Remote code execution\nA 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal. To be sure you aren’t vulnerable, you can remove the /vendor/phpunit directory from the site root of your production deployments.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6381","reference_id":"","reference_type":"","scores":[{"value":"0.03314","scoring_system":"epss","scoring_elements":"0.87217","published_at":"2026-04-02T12:55:00Z"},{"value":"0.03314","scoring_system":"epss","scoring_elements":"0.87259","published_at":"2026-04-13T12:55:00Z"},{"value":"0.03314","scoring_system":"epss","scoring_elements":"0.87263","published_at":"2026-04-12T12:55:00Z"},{"value":"0.03314","scoring_system":"epss","scoring_elements":"0.87269","published_at":"2026-04-11T12:55:00Z"},{"value":"0.03314","scoring_system":"epss","scoring_elements":"0.87233","published_at":"2026-04-04T12:55:00Z"},{"value":"0.03314","scoring_system":"epss","scoring_elements":"0.87207","published_at":"2026-04-01T12:55:00Z"},{"value":"0.03314","scoring_system":"epss","scoring_elements":"0.87257","published_at":"2026-04-09T12:55:00Z"},{"value":"0.03314","scoring_system":"epss","scoring_elements":"0.8725","published_at":"2026-04-08T12:55:00Z"},{"value":"0.03314","scoring_system":"epss","scoring_elements":"0.8723","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6381"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6381.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6381.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6381.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6381.yaml"},{"reference_url":"https://www.drupal.org/SA-2017-001","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-2017-001"},{"reference_url":"http://www.securityfocus.com/bid/96919","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/96919"},{"reference_url":"http://www.securitytracker.com/id/1038058","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securitytracker.com/id/1038058"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha10:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha10:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha10:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha11:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha11:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha11:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha12:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha12:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha12:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha13:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha13:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha13:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha14:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha14:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha14:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha15:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha15:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha15:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha3:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha3:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha3:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha4:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha4:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha4:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha5:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha5:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha5:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha6:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha6:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha6:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha7:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha7:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha7:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha8:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha8:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha8:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha9:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha9:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha9:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta10:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta10:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta10:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta11:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta11:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta11:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta12:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta12:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta12:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta13:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta13:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta13:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta14:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta14:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta14:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta15:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta15:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta15:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta16:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta16:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta16:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta3:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta3:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta3:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta4:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta4:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta4:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta6:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta6:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta6:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta7:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta7:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta7:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta9:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta9:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta9:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:rc1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:rc2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc3:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:rc3:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc3:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc4:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:rc4:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc4:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:beta1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.0:beta1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:beta1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:beta2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.0:beta2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:beta2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:rc1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.0:rc1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:rc1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.10:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.10:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.10:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.7:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.7:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.7:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.8:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.8:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.8:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.9:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.9:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.9:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6381","reference_id":"CVE-2017-6381","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:P/I:P/A:P"},{"value":"8.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6381"},{"reference_url":"https://github.com/advisories/GHSA-rhx9-3qf7-r3j7","reference_id":"GHSA-rhx9-3qf7-r3j7","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rhx9-3qf7-r3j7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23955?format=json","purl":"pkg:composer/drupal/core@8.2.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.2.7"}],"aliases":["CVE-2017-6381","GHSA-rhx9-3qf7-r3j7"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-d4qd-ut89-gbf4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/17394?format=json","vulnerability_id":"VCID-dgjq-y5zj-cud1","summary":"Improper Access Control\nUnder certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25278","reference_id":"","reference_type":"","scores":[{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.63732","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.63711","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.63737","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.63697","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.63749","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.63766","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.6378","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.63765","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25278"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2022-013","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T18:39:47Z/"}],"url":"https://www.drupal.org/sa-core-2022-013"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25278","reference_id":"CVE-2022-25278","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25278"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25278.yaml","reference_id":"CVE-2022-25278.YAML","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25278.yaml"},{"reference_url":"https://github.com/advisories/GHSA-cfh2-7f6h-3m85","reference_id":"GHSA-cfh2-7f6h-3m85","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cfh2-7f6h-3m85"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57343?format=json","purl":"pkg:composer/drupal/core@9.3.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.19"},{"url":"http://public2.vulnerablecode.io/api/packages/57345?format=json","purl":"pkg:composer/drupal/core@9.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.4.3"}],"aliases":["CVE-2022-25278","GHSA-cfh2-7f6h-3m85"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dgjq-y5zj-cud1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19208?format=json","vulnerability_id":"VCID-dqf8-ea9f-yber","summary":"Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution\nThe Contextual Links module doesn't sufficiently validate the requested contextual links.\nThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \"access contextual links\".","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2018-10-17-5.yaml","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2018-10-17-5.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-006"},{"reference_url":"https://github.com/advisories/GHSA-7v68-3pr5-h3cr","reference_id":"GHSA-7v68-3pr5-h3cr","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7v68-3pr5-h3cr"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60240?format=json","purl":"pkg:composer/drupal/core@8.5.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.5.8"},{"url":"http://public2.vulnerablecode.io/api/packages/32218?format=json","purl":"pkg:composer/drupal/core@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.2"}],"aliases":["GHSA-7v68-3pr5-h3cr"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dqf8-ea9f-yber"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/25493?format=json","vulnerability_id":"VCID-ed6y-c9tz-mbds","summary":"Drupal Core Cross-Site Scripting (XSS) Vulnerability\nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-31675","reference_id":"","reference_type":"","scores":[{"value":"0.00232","scoring_system":"epss","scoring_elements":"0.45919","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00232","scoring_system":"epss","scoring_elements":"0.45972","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00232","scoring_system":"epss","scoring_elements":"0.45968","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00232","scoring_system":"epss","scoring_elements":"0.45996","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00232","scoring_system":"epss","scoring_elements":"0.45975","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00272","scoring_system":"epss","scoring_elements":"0.50622","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-31675"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"1.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31675","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"1.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31675"},{"reference_url":"https://www.drupal.org/sa-core-2025-004","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"1.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-01T18:21:31Z/"}],"url":"https://www.drupal.org/sa-core-2025-004"},{"reference_url":"https://www.herodevs.com/vulnerability-directory/cve-2025-31675","reference_id":"cve-2025-31675","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"1.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-01T18:21:31Z/"}],"url":"https://www.herodevs.com/vulnerability-directory/cve-2025-31675"},{"reference_url":"https://github.com/advisories/GHSA-m4wj-hhwj-47qp","reference_id":"GHSA-m4wj-hhwj-47qp","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-m4wj-hhwj-47qp"},{"reference_url":"https://d7es.tag1.com/security-advisories/link-moderately-critical-cross-site-scripting-sa-core-2025-004","reference_id":"link-moderately-critical-cross-site-scripting-sa-core-2025-004","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"1.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-01T18:21:31Z/"}],"url":"https://d7es.tag1.com/security-advisories/link-moderately-critical-cross-site-scripting-sa-core-2025-004"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/68717?format=json","purl":"pkg:composer/drupal/core@10.3.14","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.3.14"},{"url":"http://public2.vulnerablecode.io/api/packages/68718?format=json","purl":"pkg:composer/drupal/core@10.4.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.4.5"},{"url":"http://public2.vulnerablecode.io/api/packages/68719?format=json","purl":"pkg:composer/drupal/core@11.0.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.0.13"},{"url":"http://public2.vulnerablecode.io/api/packages/68720?format=json","purl":"pkg:composer/drupal/core@11.1.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.1.5"}],"aliases":["CVE-2025-31675","GHSA-m4wj-hhwj-47qp"],"risk_score":2.5,"exploitability":"0.5","weighted_severity":"4.9","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ed6y-c9tz-mbds"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10219?format=json","vulnerability_id":"VCID-fm5k-u7s6-wfhb","summary":"Entity Access Bypass\nIn versions of Drupal 8 core ; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6925","reference_id":"","reference_type":"","scores":[{"value":"0.00617","scoring_system":"epss","scoring_elements":"0.69873","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00617","scoring_system":"epss","scoring_elements":"0.69888","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00617","scoring_system":"epss","scoring_elements":"0.69861","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00617","scoring_system":"epss","scoring_elements":"0.69923","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00617","scoring_system":"epss","scoring_elements":"0.69938","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00617","scoring_system":"epss","scoring_elements":"0.69953","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00617","scoring_system":"epss","scoring_elements":"0.69929","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00617","scoring_system":"epss","scoring_elements":"0.69913","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00617","scoring_system":"epss","scoring_elements":"0.69865","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6925"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6925.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6925.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6925.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6925.yaml"},{"reference_url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple"},{"reference_url":"https://www.drupal.org/SA-CORE-2017-004","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2017-004"},{"reference_url":"http://www.securityfocus.com/bid/100368","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/100368"},{"reference_url":"http://www.securitytracker.com/id/1039200","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securitytracker.com/id/1039200"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6925","reference_id":"CVE-2017-6925","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},{"value":"9.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6925"},{"reference_url":"https://github.com/advisories/GHSA-f4qx-jqfq-7785","reference_id":"GHSA-f4qx-jqfq-7785","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-f4qx-jqfq-7785"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/34582?format=json","purl":"pkg:composer/drupal/core@8.3.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-yare-57j9-j7cs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.3.7"}],"aliases":["CVE-2017-6925","GHSA-f4qx-jqfq-7785"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fm5k-u7s6-wfhb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12876?format=json","vulnerability_id":"VCID-fwbj-ctxz-2bc6","summary":"Incorrect Authorization\nThe QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13676","reference_id":"","reference_type":"","scores":[{"value":"0.00285","scoring_system":"epss","scoring_elements":"0.51854","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00285","scoring_system":"epss","scoring_elements":"0.51748","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00285","scoring_system":"epss","scoring_elements":"0.51797","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00285","scoring_system":"epss","scoring_elements":"0.51823","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00285","scoring_system":"epss","scoring_elements":"0.51784","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00285","scoring_system":"epss","scoring_elements":"0.51839","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00285","scoring_system":"epss","scoring_elements":"0.51837","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00285","scoring_system":"epss","scoring_elements":"0.51888","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00285","scoring_system":"epss","scoring_elements":"0.5187","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13676"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/8e8e3d2ddd72471ba886346ecabfb5d98fd27d9b","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/8e8e3d2ddd72471ba886346ecabfb5d98fd27d9b"},{"reference_url":"https://www.drupal.org/sa-core-2021-009","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2021-009"},{"reference_url":"https://security.archlinux.org/AVG-2407","reference_id":"AVG-2407","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-2407"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13676","reference_id":"CVE-2020-13676","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13676"},{"reference_url":"https://github.com/advisories/GHSA-qfhg-m6r8-xxpj","reference_id":"GHSA-qfhg-m6r8-xxpj","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qfhg-m6r8-xxpj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46155?format=json","purl":"pkg:composer/drupal/core@8.9.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.19"},{"url":"http://public2.vulnerablecode.io/api/packages/46118?format=json","purl":"pkg:composer/drupal/core@9.1.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.13"},{"url":"http://public2.vulnerablecode.io/api/packages/46119?format=json","purl":"pkg:composer/drupal/core@9.2.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-674z-nf4t-b7ez"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-b4yh-gyrx-3yhh"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-zw3u-6ue7-efdf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.2.6"}],"aliases":["CVE-2020-13676","GHSA-qfhg-m6r8-xxpj"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fwbj-ctxz-2bc6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8828?format=json","vulnerability_id":"VCID-g1rp-twzp-63e1","summary":"Cross-site Scripting\nA jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6929","reference_id":"","reference_type":"","scores":[{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.69505","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.69559","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.69573","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.69588","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.69567","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.6955","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.695","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.6952","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.69494","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6929"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6929.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6929.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6929.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6929.yaml"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6929","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6929"},{"reference_url":"https://www.debian.org/security/2018/dsa-4123","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2018/dsa-4123"},{"reference_url":"https://www.drupal.org/sa-core-2018-001","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-001"},{"reference_url":"https://www.drupal.org/SA-CORE-2018-001","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2018-001"},{"reference_url":"https://github.com/advisories/GHSA-5vpr-v24w-mmjj","reference_id":"GHSA-5vpr-v24w-mmjj","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5vpr-v24w-mmjj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54634?format=json","purl":"pkg:composer/drupal/core@8.4.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-yare-57j9-j7cs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.4.0"},{"url":"http://public2.vulnerablecode.io/api/packages/26566?format=json","purl":"pkg:composer/drupal/core@8.4.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.4.5"}],"aliases":["CVE-2017-6929","GHSA-5vpr-v24w-mmjj"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-g1rp-twzp-63e1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22363?format=json","vulnerability_id":"VCID-g33x-1paw-7udm","summary":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-13081","reference_id":"","reference_type":"","scores":[{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29467","published_at":"2026-04-12T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29511","published_at":"2026-04-11T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29415","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.41909","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.41955","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.41983","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.41971","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.41959","published_at":"2026-04-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-13081"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"},{"value":"4.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2025-006","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"},{"value":"4.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-11-19T04:55:20Z/"}],"url":"https://www.drupal.org/sa-core-2025-006"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13081","reference_id":"CVE-2025-13081","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"},{"value":"4.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13081"},{"reference_url":"https://github.com/advisories/GHSA-m6vv-vcj8-w8m7","reference_id":"GHSA-m6vv-vcj8-w8m7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-m6vv-vcj8-w8m7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/64942?format=json","purl":"pkg:composer/drupal/core@10.4.9","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.4.9"},{"url":"http://public2.vulnerablecode.io/api/packages/64943?format=json","purl":"pkg:composer/drupal/core@10.5.6","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.5.6"},{"url":"http://public2.vulnerablecode.io/api/packages/64944?format=json","purl":"pkg:composer/drupal/core@11.1.9","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.1.9"},{"url":"http://public2.vulnerablecode.io/api/packages/64945?format=json","purl":"pkg:composer/drupal/core@11.2.8","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.2.8"}],"aliases":["CVE-2025-13081","GHSA-m6vv-vcj8-w8m7"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-g33x-1paw-7udm"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/15382?format=json","vulnerability_id":"VCID-ga35-289v-vqhr","summary":"Drupal Core Remote Code Execution Vulnerability\nDrupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-7600","reference_id":"","reference_type":"","scores":[{"value":"0.94489","scoring_system":"epss","scoring_elements":"1.0","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-7600"},{"reference_url":"https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600"},{"reference_url":"https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7600","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7600"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://greysec.net/showthread.php?tid=2912&pid=10561","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://greysec.net/showthread.php?tid=2912&pid=10561"},{"reference_url":"https://groups.drupal.org/security/faq-2018-002","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://groups.drupal.org/security/faq-2018-002"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html"},{"reference_url":"https://research.checkpoint.com/uncovering-drupalgeddon-2","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://research.checkpoint.com/uncovering-drupalgeddon-2"},{"reference_url":"https://twitter.com/arancaytar/status/979090719003627521","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://twitter.com/arancaytar/status/979090719003627521"},{"reference_url":"https://twitter.com/RicterZ/status/979567469726613504","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://twitter.com/RicterZ/status/979567469726613504"},{"reference_url":"https://twitter.com/RicterZ/status/984495201354854401","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://twitter.com/RicterZ/status/984495201354854401"},{"reference_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600"},{"reference_url":"https://www.debian.org/security/2018/dsa-4156","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://www.debian.org/security/2018/dsa-4156"},{"reference_url":"https://www.drupal.org/sa-core-2018-002","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://www.drupal.org/sa-core-2018-002"},{"reference_url":"https://www.exploit-db.com/exploits/44448","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/44448"},{"reference_url":"https://www.exploit-db.com/exploits/44449","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/44449"},{"reference_url":"https://www.exploit-db.com/exploits/44482","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/44482"},{"reference_url":"https://www.synology.com/support/security/Synology_SA_18_17","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://www.synology.com/support/security/Synology_SA_18_17"},{"reference_url":"https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know"},{"reference_url":"http://www.securityfocus.com/bid/103534","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"http://www.securityfocus.com/bid/103534"},{"reference_url":"http://www.securitytracker.com/id/1040598","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"http://www.securitytracker.com/id/1040598"},{"reference_url":"https://www.exploit-db.com/exploits/44448/","reference_id":"44448","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://www.exploit-db.com/exploits/44448/"},{"reference_url":"https://www.exploit-db.com/exploits/44449/","reference_id":"44449","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://www.exploit-db.com/exploits/44449/"},{"reference_url":"https://www.exploit-db.com/exploits/44482/","reference_id":"44482","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://www.exploit-db.com/exploits/44482/"},{"reference_url":"https://security.archlinux.org/ASA-201804-1","reference_id":"ASA-201804-1","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-201804-1"},{"reference_url":"https://security.archlinux.org/AVG-665","reference_id":"AVG-665","reference_type":"","scores":[{"value":"Critical","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-665"},{"reference_url":"https://github.com/a2u/CVE-2018-7600","reference_id":"CVE-2018-7600","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://github.com/a2u/CVE-2018-7600"},{"reference_url":"https://github.com/a2u/CVE-2018-7600/blob/2c623a6a9ea641119cf7ee75cd344fb32047169b/exploit.py","reference_id":"CVE-2018-7600","reference_type":"exploit","scores":[],"url":"https://github.com/a2u/CVE-2018-7600/blob/2c623a6a9ea641119cf7ee75cd344fb32047169b/exploit.py"},{"reference_url":"https://github.com/dreadlocked/Drupalgeddon2/blob/16cac1b2336d38642f75eb7b7e2c833b2c3f49b1/drupalgeddon2.rb","reference_id":"CVE-2018-7600","reference_type":"exploit","scores":[],"url":"https://github.com/dreadlocked/Drupalgeddon2/blob/16cac1b2336d38642f75eb7b7e2c833b2c3f49b1/drupalgeddon2.rb"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/remote/44482.rb","reference_id":"CVE-2018-7600","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/remote/44482.rb"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/44448.py","reference_id":"CVE-2018-7600","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/44448.py"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/44449.rb","reference_id":"CVE-2018-7600","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/44449.rb"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7600","reference_id":"CVE-2018-7600","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7600"},{"reference_url":"https://github.com/g0rx/CVE-2018-7600-Drupal-RCE","reference_id":"CVE-2018-7600-DRUPAL-RCE","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://github.com/g0rx/CVE-2018-7600-Drupal-RCE"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7600.yaml","reference_id":"CVE-2018-7600.YAML","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7600.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7600.yaml","reference_id":"CVE-2018-7600.YAML","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7600.yaml"},{"reference_url":"https://github.com/advisories/GHSA-7fh9-933g-885p","reference_id":"GHSA-7fh9-933g-885p","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7fh9-933g-885p"},{"reference_url":"https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/","reference_id":"over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/"},{"reference_url":"https://research.checkpoint.com/uncovering-drupalgeddon-2/","reference_id":"uncovering-drupalgeddon-2","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:40:15Z/"}],"url":"https://research.checkpoint.com/uncovering-drupalgeddon-2/"},{"reference_url":"https://usn.ubuntu.com/USN-4773-1/","reference_id":"USN-USN-4773-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/USN-4773-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54636?format=json","purl":"pkg:composer/drupal/core@8.3.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.3.9"},{"url":"http://public2.vulnerablecode.io/api/packages/54637?format=json","purl":"pkg:composer/drupal/core@8.4.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.4.6"},{"url":"http://public2.vulnerablecode.io/api/packages/54638?format=json","purl":"pkg:composer/drupal/core@8.5.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.5.1"}],"aliases":["CVE-2018-7600","GHSA-7fh9-933g-885p"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ga35-289v-vqhr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9964?format=json","vulnerability_id":"VCID-gzcu-sbks-wyfa","summary":"URL Redirection to Untrusted Site ('Open Redirect')\nExternal URL injection through URL aliases in drupal.","references":[{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2018-006"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/32218?format=json","purl":"pkg:composer/drupal/core@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.2"}],"aliases":["2018-10-17-2"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gzcu-sbks-wyfa"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22349?format=json","vulnerability_id":"VCID-hgb1-xrne-e7c8","summary":"Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-13080","reference_id":"","reference_type":"","scores":[{"value":"0.00082","scoring_system":"epss","scoring_elements":"0.24067","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00082","scoring_system":"epss","scoring_elements":"0.23969","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00082","scoring_system":"epss","scoring_elements":"0.24025","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00102","scoring_system":"epss","scoring_elements":"0.28019","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00102","scoring_system":"epss","scoring_elements":"0.28086","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00102","scoring_system":"epss","scoring_elements":"0.28224","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00102","scoring_system":"epss","scoring_elements":"0.28129","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00102","scoring_system":"epss","scoring_elements":"0.28181","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-13080"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"2.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2025-005","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"2.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-11-18T20:35:13Z/"}],"url":"https://www.drupal.org/sa-core-2025-005"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13080","reference_id":"CVE-2025-13080","reference_type":"","scores":[{"value":"2.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13080"},{"reference_url":"https://github.com/advisories/GHSA-83v7-c2cf-p9c2","reference_id":"GHSA-83v7-c2cf-p9c2","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-83v7-c2cf-p9c2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/64942?format=json","purl":"pkg:composer/drupal/core@10.4.9","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.4.9"},{"url":"http://public2.vulnerablecode.io/api/packages/64943?format=json","purl":"pkg:composer/drupal/core@10.5.6","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.5.6"},{"url":"http://public2.vulnerablecode.io/api/packages/64944?format=json","purl":"pkg:composer/drupal/core@11.1.9","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.1.9"},{"url":"http://public2.vulnerablecode.io/api/packages/64945?format=json","purl":"pkg:composer/drupal/core@11.2.8","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.2.8"}],"aliases":["CVE-2025-13080","GHSA-83v7-c2cf-p9c2"],"risk_score":1.9,"exploitability":"0.5","weighted_severity":"3.7","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hgb1-xrne-e7c8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7848?format=json","vulnerability_id":"VCID-hpsp-5qtj-v7dq","summary":"Access Bypass\nWhen adding a private file via the editor in Drupal, the editor will not correctly check access for the file being attached, resulting in an access bypass.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6377","reference_id":"","reference_type":"","scores":[{"value":"0.00288","scoring_system":"epss","scoring_elements":"0.52172","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00288","scoring_system":"epss","scoring_elements":"0.52234","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00288","scoring_system":"epss","scoring_elements":"0.52248","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00288","scoring_system":"epss","scoring_elements":"0.52264","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00288","scoring_system":"epss","scoring_elements":"0.52213","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00288","scoring_system":"epss","scoring_elements":"0.52217","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00288","scoring_system":"epss","scoring_elements":"0.52164","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00288","scoring_system":"epss","scoring_elements":"0.52199","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00288","scoring_system":"epss","scoring_elements":"0.52129","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6377"},{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6377.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6377.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6377.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6377.yaml"},{"reference_url":"https://www.drupal.org/SA-2017-001","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-2017-001"},{"reference_url":"http://www.securityfocus.com/bid/96919","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/96919"},{"reference_url":"http://www.securitytracker.com/id/1038058","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securitytracker.com/id/1038058"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6377","reference_id":"CVE-2017-6377","reference_type":"","scores":[{"value":"5.0","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:N/C:N/I:P/A:N"},{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6377"},{"reference_url":"https://github.com/advisories/GHSA-w7qx-vwr9-2j3r","reference_id":"GHSA-w7qx-vwr9-2j3r","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-w7qx-vwr9-2j3r"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23955?format=json","purl":"pkg:composer/drupal/core@8.2.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.2.7"}],"aliases":["CVE-2017-6377","GHSA-w7qx-vwr9-2j3r"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hpsp-5qtj-v7dq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22343?format=json","vulnerability_id":"VCID-hwnd-nuv7-jqbh","summary":"User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-13082","reference_id":"","reference_type":"","scores":[{"value":"0.00039","scoring_system":"epss","scoring_elements":"0.11666","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00039","scoring_system":"epss","scoring_elements":"0.11603","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00039","scoring_system":"epss","scoring_elements":"0.1163","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00073","scoring_system":"epss","scoring_elements":"0.22125","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00073","scoring_system":"epss","scoring_elements":"0.22208","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00073","scoring_system":"epss","scoring_elements":"0.2234","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00073","scoring_system":"epss","scoring_elements":"0.22263","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00073","scoring_system":"epss","scoring_elements":"0.22297","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-13082"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"2.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2025-007","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"},{"value":"2.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-18T20:32:40Z/"}],"url":"https://www.drupal.org/sa-core-2025-007"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13082","reference_id":"CVE-2025-13082","reference_type":"","scores":[{"value":"2.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13082"},{"reference_url":"https://github.com/advisories/GHSA-h89p-5896-f4q8","reference_id":"GHSA-h89p-5896-f4q8","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-h89p-5896-f4q8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/64942?format=json","purl":"pkg:composer/drupal/core@10.4.9","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.4.9"},{"url":"http://public2.vulnerablecode.io/api/packages/64943?format=json","purl":"pkg:composer/drupal/core@10.5.6","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.5.6"},{"url":"http://public2.vulnerablecode.io/api/packages/64944?format=json","purl":"pkg:composer/drupal/core@11.1.9","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.1.9"},{"url":"http://public2.vulnerablecode.io/api/packages/64945?format=json","purl":"pkg:composer/drupal/core@11.2.8","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.2.8"}],"aliases":["CVE-2025-13082","GHSA-h89p-5896-f4q8"],"risk_score":1.5,"exploitability":"0.5","weighted_severity":"3.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hwnd-nuv7-jqbh"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9732?format=json","vulnerability_id":"VCID-hzr8-ttbu-ebhg","summary":"PECL YAML parser unsafe object handling\nPECL YAML parser does not handle PHP objects safely during certain operations within Drupal core. This can lead to remote code execution.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6920","reference_id":"","reference_type":"","scores":[{"value":"0.66148","scoring_system":"epss","scoring_elements":"0.98509","published_at":"2026-04-02T12:55:00Z"},{"value":"0.66148","scoring_system":"epss","scoring_elements":"0.98518","published_at":"2026-04-13T12:55:00Z"},{"value":"0.66148","scoring_system":"epss","scoring_elements":"0.98516","published_at":"2026-04-09T12:55:00Z"},{"value":"0.66148","scoring_system":"epss","scoring_elements":"0.98515","published_at":"2026-04-08T12:55:00Z"},{"value":"0.66148","scoring_system":"epss","scoring_elements":"0.98512","published_at":"2026-04-07T12:55:00Z"},{"value":"0.66148","scoring_system":"epss","scoring_elements":"0.98511","published_at":"2026-04-04T12:55:00Z"},{"value":"0.66148","scoring_system":"epss","scoring_elements":"0.98507","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6920"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6920.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6920.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6920.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6920.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6920","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6920"},{"reference_url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple"},{"reference_url":"https://www.drupal.org/SA-CORE-2017-003","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2017-003"},{"reference_url":"http://www.securityfocus.com/bid/99211","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/99211"},{"reference_url":"http://www.securitytracker.com/id/1038781","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securitytracker.com/id/1038781"},{"reference_url":"https://github.com/advisories/GHSA-9c24-g32g-35rj","reference_id":"GHSA-9c24-g32g-35rj","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9c24-g32g-35rj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/29924?format=json","purl":"pkg:composer/drupal/core@8.3.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-yare-57j9-j7cs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.3.4"}],"aliases":["CVE-2017-6920","GHSA-9c24-g32g-35rj"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hzr8-ttbu-ebhg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/25285?format=json","vulnerability_id":"VCID-j21d-w3g7-cbcg","summary":"Drupal Core Vulnerable to Forceful Browsing\nIncorrect Authorization vulnerability in Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-31673","reference_id":"","reference_type":"","scores":[{"value":"0.00177","scoring_system":"epss","scoring_elements":"0.39249","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00177","scoring_system":"epss","scoring_elements":"0.39281","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00177","scoring_system":"epss","scoring_elements":"0.39304","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00177","scoring_system":"epss","scoring_elements":"0.39223","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00177","scoring_system":"epss","scoring_elements":"0.39278","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00177","scoring_system":"epss","scoring_elements":"0.39294","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00177","scoring_system":"epss","scoring_elements":"0.39306","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00177","scoring_system":"epss","scoring_elements":"0.39268","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-31673"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31673","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31673"},{"reference_url":"https://www.drupal.org/sa-core-2025-002","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-29T15:47:04Z/"}],"url":"https://www.drupal.org/sa-core-2025-002"},{"reference_url":"https://github.com/advisories/GHSA-wpp8-fjgf-pwc7","reference_id":"GHSA-wpp8-fjgf-pwc7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wpp8-fjgf-pwc7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/68503?format=json","purl":"pkg:composer/drupal/core@10.3.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.3.13"},{"url":"http://public2.vulnerablecode.io/api/packages/68504?format=json","purl":"pkg:composer/drupal/core@10.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.4.3"},{"url":"http://public2.vulnerablecode.io/api/packages/68505?format=json","purl":"pkg:composer/drupal/core@11.0.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.0.12"},{"url":"http://public2.vulnerablecode.io/api/packages/68506?format=json","purl":"pkg:composer/drupal/core@11.1.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.1.3"}],"aliases":["CVE-2025-31673","GHSA-wpp8-fjgf-pwc7"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-j21d-w3g7-cbcg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/15106?format=json","vulnerability_id":"VCID-jctf-yffu-hbag","summary":"Drupal core Denial of Service vulnerability\nThe Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).\n\nSites that do not use the Comment module are not affected.","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/2f76ac716ca8019bc60579fdfc8aa6cd65d57dff","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/2f76ac716ca8019bc60579fdfc8aa6cd65d57dff"},{"reference_url":"https://github.com/drupal/core/commit/5e606b560ac4ecb08135f12b6165bbe0348346a0","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/5e606b560ac4ecb08135f12b6165bbe0348346a0"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2024-01-17.yaml","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2024-01-17.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2024-001","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2024-001"},{"reference_url":"https://github.com/advisories/GHSA-6ccv-8fgf-cjpw","reference_id":"GHSA-6ccv-8fgf-cjpw","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6ccv-8fgf-cjpw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52695?format=json","purl":"pkg:composer/drupal/core@10.1.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u2d4-5g3d-zqbt"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.1.8"},{"url":"http://public2.vulnerablecode.io/api/packages/52696?format=json","purl":"pkg:composer/drupal/core@10.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u2d4-5g3d-zqbt"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.2.2"}],"aliases":["GHSA-6ccv-8fgf-cjpw","GMS-2024-214"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jctf-yffu-hbag"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8836?format=json","vulnerability_id":"VCID-jnu7-1j9c-dqck","summary":"JavaScript cross-site scripting prevention is incomplete\nDrupal has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output is not auto-escaped by either Drupal 7 or Drupal 8). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6927","reference_id":"","reference_type":"","scores":[{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80305","published_at":"2026-04-02T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80325","published_at":"2026-04-04T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80297","published_at":"2026-04-01T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.8035","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80356","published_at":"2026-04-12T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80371","published_at":"2026-04-11T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80352","published_at":"2026-04-09T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80341","published_at":"2026-04-08T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80313","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6927"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6927.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6927.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6927.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6927.yaml"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6927","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6927"},{"reference_url":"https://www.debian.org/security/2018/dsa-4123","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2018/dsa-4123"},{"reference_url":"https://www.drupal.org/sa-core-2018-001","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-001"},{"reference_url":"https://www.drupal.org/SA-CORE-2018-001","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2018-001"},{"reference_url":"http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6927","reference_id":"","reference_type":"","scores":[],"url":"http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6927"},{"reference_url":"http://www.securityfocus.com/bid/103138","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/103138"},{"reference_url":"https://github.com/advisories/GHSA-585j-5449-mf5m","reference_id":"GHSA-585j-5449-mf5m","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-585j-5449-mf5m"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26566?format=json","purl":"pkg:composer/drupal/core@8.4.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.4.5"}],"aliases":["CVE-2017-6927","GHSA-585j-5449-mf5m"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jnu7-1j9c-dqck"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19583?format=json","vulnerability_id":"VCID-jrb8-jnz4-83c8","summary":"Drupal core uses a vulnerable Third-party library CKEditor\nThe Drupal project uses the third-party library [CKEditor](https://github.com/ckeditor/ckeditor4), which has released a [security improvement](https://ckeditor.com/blog/CKEditor-4.14-with-Paste-from-LibreOffice-released/#security-issues-fixed) that is needed to protect some Drupal configurations.\n\nVulnerabilities are possible if Drupal is configured to use the WYSIWYG CKEditor for your site's users. An attacker that can create or edit content may be able to exploit this Cross Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG CKEditor, and this may include site admins with privileged access.\n\nThe latest versions of Drupal update CKEditor to 4.14 to mitigate the vulnerabilities.","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2020-03-18.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2020-03-18.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2020-001","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-001"},{"reference_url":"https://github.com/advisories/GHSA-v273-j5hq-26xp","reference_id":"GHSA-v273-j5hq-26xp","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v273-j5hq-26xp"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60759?format=json","purl":"pkg:composer/drupal/core@8.7.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.7.12"},{"url":"http://public2.vulnerablecode.io/api/packages/60761?format=json","purl":"pkg:composer/drupal/core@8.8.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9qyz-jfgb-5yfs"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-agtf-c53h-2fdx"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-mhk6-9qdy-83f3"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-ptxz-rvbt-hqhz"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-rxhd-nkpr-87fm"},{"vulnerability":"VCID-ssyn-dxp9-3kdq"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.4"}],"aliases":["GHSA-v273-j5hq-26xp"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jrb8-jnz4-83c8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12878?format=json","vulnerability_id":"VCID-k1gx-nznx-7qd6","summary":"Drupal core Cross-site Scripting (XSS) vulnerability\nCross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13672","reference_id":"","reference_type":"","scores":[{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68347","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68413","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68446","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68458","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68431","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68414","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68363","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68387","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68367","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13672"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2021-002","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2021-002"},{"reference_url":"https://security.archlinux.org/AVG-1463","reference_id":"AVG-1463","reference_type":"","scores":[{"value":"Critical","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1463"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13672","reference_id":"CVE-2020-13672","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13672"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13672.yaml","reference_id":"CVE-2020-13672.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13672.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13672.yaml","reference_id":"CVE-2020-13672.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13672.yaml"},{"reference_url":"https://github.com/advisories/GHSA-3m36-mjwj-352c","reference_id":"GHSA-3m36-mjwj-352c","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3m36-mjwj-352c"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46164?format=json","purl":"pkg:composer/drupal/core@8.9.14","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.14"},{"url":"http://public2.vulnerablecode.io/api/packages/46166?format=json","purl":"pkg:composer/drupal/core@9.0.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.12"},{"url":"http://public2.vulnerablecode.io/api/packages/46167?format=json","purl":"pkg:composer/drupal/core@9.1.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.7"}],"aliases":["CVE-2020-13672","GHSA-3m36-mjwj-352c"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-k1gx-nznx-7qd6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/25336?format=json","vulnerability_id":"VCID-kam1-84p4-qych","summary":"Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability\nImproperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-31674","reference_id":"","reference_type":"","scores":[{"value":"0.00845","scoring_system":"epss","scoring_elements":"0.7477","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00845","scoring_system":"epss","scoring_elements":"0.74785","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00845","scoring_system":"epss","scoring_elements":"0.74794","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00845","scoring_system":"epss","scoring_elements":"0.74777","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00845","scoring_system":"epss","scoring_elements":"0.74744","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00845","scoring_system":"epss","scoring_elements":"0.74815","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00845","scoring_system":"epss","scoring_elements":"0.74791","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00845","scoring_system":"epss","scoring_elements":"0.74743","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-31674"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"4.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31674","reference_id":"","reference_type":"","scores":[{"value":"4.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31674"},{"reference_url":"https://www.drupal.org/sa-core-2025-003","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"4.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-03T17:16:59Z/"}],"url":"https://www.drupal.org/sa-core-2025-003"},{"reference_url":"https://github.com/advisories/GHSA-2qph-q8xw-gv7q","reference_id":"GHSA-2qph-q8xw-gv7q","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2qph-q8xw-gv7q"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/68503?format=json","purl":"pkg:composer/drupal/core@10.3.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.3.13"},{"url":"http://public2.vulnerablecode.io/api/packages/68504?format=json","purl":"pkg:composer/drupal/core@10.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.4.3"},{"url":"http://public2.vulnerablecode.io/api/packages/68505?format=json","purl":"pkg:composer/drupal/core@11.0.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.0.12"},{"url":"http://public2.vulnerablecode.io/api/packages/68506?format=json","purl":"pkg:composer/drupal/core@11.1.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.1.3"}],"aliases":["CVE-2025-31674","GHSA-2qph-q8xw-gv7q"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kam1-84p4-qych"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19564?format=json","vulnerability_id":"VCID-kdnk-7mz5-7ugf","summary":"Drupal Content moderation Access bypass\nIn some conditions, drupal content moderation fails to check a users access to use certain transitions, leading to an access bypass.","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2018-10-17-1.yaml","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2018-10-17-1.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-006"},{"reference_url":"https://github.com/advisories/GHSA-f84q-mgj9-8jfc","reference_id":"GHSA-f84q-mgj9-8jfc","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-f84q-mgj9-8jfc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60240?format=json","purl":"pkg:composer/drupal/core@8.5.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.5.8"},{"url":"http://public2.vulnerablecode.io/api/packages/32218?format=json","purl":"pkg:composer/drupal/core@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.2"}],"aliases":["GHSA-f84q-mgj9-8jfc"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kdnk-7mz5-7ugf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10220?format=json","vulnerability_id":"VCID-krhy-kg1b-rfbk","summary":"File REST resource does not properly validate\nThe file REST resource does not properly validate some fields when manipulating files. the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6921","reference_id":"","reference_type":"","scores":[{"value":"0.00463","scoring_system":"epss","scoring_elements":"0.64204","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00463","scoring_system":"epss","scoring_elements":"0.64289","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00463","scoring_system":"epss","scoring_elements":"0.64262","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00463","scoring_system":"epss","scoring_elements":"0.6429","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00463","scoring_system":"epss","scoring_elements":"0.64316","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00463","scoring_system":"epss","scoring_elements":"0.64327","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00463","scoring_system":"epss","scoring_elements":"0.64314","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00463","scoring_system":"epss","scoring_elements":"0.64299","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00463","scoring_system":"epss","scoring_elements":"0.64249","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6921"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6921.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6921.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6921.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6921.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6921","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:N/I:P/A:N"},{"value":"5.9","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6921"},{"reference_url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple"},{"reference_url":"https://www.drupal.org/SA-CORE-2017-003","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2017-003"},{"reference_url":"http://www.securityfocus.com/bid/99222","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/99222"},{"reference_url":"http://www.securitytracker.com/id/1038781","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securitytracker.com/id/1038781"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://github.com/advisories/GHSA-h377-287m-w2r9","reference_id":"GHSA-h377-287m-w2r9","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-h377-287m-w2r9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/29924?format=json","purl":"pkg:composer/drupal/core@8.3.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-yare-57j9-j7cs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.3.4"}],"aliases":["CVE-2017-6921","GHSA-h377-287m-w2r9"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-krhy-kg1b-rfbk"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7850?format=json","vulnerability_id":"VCID-m1ur-bb9m-m7d5","summary":"Cross Site Request Forgery\nSome administrative paths did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6379","reference_id":"","reference_type":"","scores":[{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.40894","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.40957","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.40974","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.41009","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.40991","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.40983","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.40934","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.41008","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.40975","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6379"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6379.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6379.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6379.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6379.yaml"},{"reference_url":"https://www.drupal.org/SA-2017-001","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-2017-001"},{"reference_url":"http://www.securityfocus.com/bid/96919","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/96919"},{"reference_url":"http://www.securitytracker.com/id/1038058","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securitytracker.com/id/1038058"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6379","reference_id":"CVE-2017-6379","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:H/Au:N/C:P/I:P/A:P"},{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6379"},{"reference_url":"https://github.com/advisories/GHSA-gxxq-fhc7-3jv9","reference_id":"GHSA-gxxq-fhc7-3jv9","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gxxq-fhc7-3jv9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23955?format=json","purl":"pkg:composer/drupal/core@8.2.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.2.7"}],"aliases":["CVE-2017-6379","GHSA-gxxq-fhc7-3jv9"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-m1ur-bb9m-m7d5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/17401?format=json","vulnerability_id":"VCID-mapb-hsvc-2khc","summary":"Unrestricted Upload of File with Dangerous Type\nDrupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously does not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25277","reference_id":"","reference_type":"","scores":[{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.5268","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.52734","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.5275","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.52766","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.52716","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.52722","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.52671","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.52706","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25277"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/1cd1830d79f221cc8490f53c2bb487dd07094f17","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/1cd1830d79f221cc8490f53c2bb487dd07094f17"},{"reference_url":"https://github.com/drupal/core/commit/5d464ea4407c50e40dcf6cb5ee376e7b8dd36f3a","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/5d464ea4407c50e40dcf6cb5ee376e7b8dd36f3a"},{"reference_url":"https://www.drupal.org/sa-core-2022-014","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-03T18:41:13Z/"}],"url":"https://www.drupal.org/sa-core-2022-014"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25277","reference_id":"CVE-2022-25277","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25277"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25277.yaml","reference_id":"CVE-2022-25277.YAML","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25277.yaml"},{"reference_url":"https://github.com/advisories/GHSA-6955-67hm-vjjq","reference_id":"GHSA-6955-67hm-vjjq","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6955-67hm-vjjq"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57343?format=json","purl":"pkg:composer/drupal/core@9.3.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.19"},{"url":"http://public2.vulnerablecode.io/api/packages/57345?format=json","purl":"pkg:composer/drupal/core@9.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.4.3"}],"aliases":["CVE-2022-25277","GHSA-6955-67hm-vjjq","GMS-2022-3361"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-mapb-hsvc-2khc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12877?format=json","vulnerability_id":"VCID-n119-gta2-kfg1","summary":"Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor\nCross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13669","reference_id":"","reference_type":"","scores":[{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42418","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42471","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42501","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42538","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42516","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42506","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42455","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42518","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42489","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13669"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2020-010","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-010"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13669","reference_id":"CVE-2020-13669","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13669"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13669.yaml","reference_id":"CVE-2020-13669.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13669.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13669.yaml","reference_id":"CVE-2020-13669.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13669.yaml"},{"reference_url":"https://github.com/advisories/GHSA-c533-c843-67h8","reference_id":"GHSA-c533-c843-67h8","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-c533-c843-67h8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46171?format=json","purl":"pkg:composer/drupal/core@8.8.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.10"},{"url":"http://public2.vulnerablecode.io/api/packages/46146?format=json","purl":"pkg:composer/drupal/core@8.9.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.6"},{"url":"http://public2.vulnerablecode.io/api/packages/46147?format=json","purl":"pkg:composer/drupal/core@9.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.6"}],"aliases":["CVE-2020-13669","GHSA-c533-c843-67h8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-n119-gta2-kfg1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/17393?format=json","vulnerability_id":"VCID-n7un-zgqv-jfef","summary":"Lack of domain validation in Druple core\nThe Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25276","reference_id":"","reference_type":"","scores":[{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79371","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.7933","published_at":"2026-04-02T12:55:00Z"},{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79353","published_at":"2026-04-04T12:55:00Z"},{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79339","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79365","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79374","published_at":"2026-04-09T12:55:00Z"},{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79397","published_at":"2026-04-11T12:55:00Z"},{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79382","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25276"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2022-015","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2022-015"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25276","reference_id":"CVE-2022-25276","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25276"},{"reference_url":"https://github.com/advisories/GHSA-4wfq-jc9h-vpcx","reference_id":"GHSA-4wfq-jc9h-vpcx","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-4wfq-jc9h-vpcx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57343?format=json","purl":"pkg:composer/drupal/core@9.3.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.19"},{"url":"http://public2.vulnerablecode.io/api/packages/57345?format=json","purl":"pkg:composer/drupal/core@9.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.4.3"}],"aliases":["CVE-2022-25276","GHSA-4wfq-jc9h-vpcx"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-n7un-zgqv-jfef"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8893?format=json","vulnerability_id":"VCID-nc36-atc6-yua6","summary":"XSS Vulnerability\nCKEditor, a third-party JavaScript library included in Drupal core, is affected by a cross-site scripting (XSS) vulnerability. It's possible to execute XSS inside CKEditor when using the `image2` plugin.","references":[{"reference_url":"https://www.drupal.org/sa-core-2018-003","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2018-003"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/27004?format=json","purl":"pkg:composer/drupal/core@8.4.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.4.7"},{"url":"http://public2.vulnerablecode.io/api/packages/27006?format=json","purl":"pkg:composer/drupal/core@8.5.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.5.2"}],"aliases":["SA-CORE-2018-003"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nc36-atc6-yua6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9971?format=json","vulnerability_id":"VCID-nd8n-5dsu-2fbp","summary":"Code Injection\nInjection in `DefaultMailSystem::mail()`.","references":[{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2018-006"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/32218?format=json","purl":"pkg:composer/drupal/core@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.2"}],"aliases":["2018-10-17-4"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nd8n-5dsu-2fbp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19883?format=json","vulnerability_id":"VCID-qvbt-7e55-4bg4","summary":"Drupal core Cross-Site Scripting (XSS) vulnerabilities\nThe Drupal project uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.\n\nVulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2021-05-26.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2021-05-26.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2021-005","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2021-005"},{"reference_url":"https://github.com/advisories/GHSA-vfgc-c76h-mwh4","reference_id":"GHSA-vfgc-c76h-mwh4","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vfgc-c76h-mwh4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61213?format=json","purl":"pkg:composer/drupal/core@8.9.18","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.18"},{"url":"http://public2.vulnerablecode.io/api/packages/61215?format=json","purl":"pkg:composer/drupal/core@9.1.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.12"},{"url":"http://public2.vulnerablecode.io/api/packages/61218?format=json","purl":"pkg:composer/drupal/core@9.2.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-674z-nf4t-b7ez"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-b4yh-gyrx-3yhh"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-zw3u-6ue7-efdf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.2.4"}],"aliases":["GHSA-vfgc-c76h-mwh4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-qvbt-7e55-4bg4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/14777?format=json","vulnerability_id":"VCID-rhj7-dy7q-jkhw","summary":"Drupal Core Remote Code Execution Vulnerability\nSome field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6340","reference_id":"","reference_type":"","scores":[{"value":"0.94436","scoring_system":"epss","scoring_elements":"0.99988","published_at":"2026-04-04T12:55:00Z"},{"value":"0.94436","scoring_system":"epss","scoring_elements":"0.99987","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6340"},{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340"},{"reference_url":"https://www.drupal.org/sa-core-2019-003","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:47Z/"}],"url":"https://www.drupal.org/sa-core-2019-003"},{"reference_url":"https://www.exploit-db.com/exploits/46452","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/46452"},{"reference_url":"https://www.exploit-db.com/exploits/46452/","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:47Z/"}],"url":"https://www.exploit-db.com/exploits/46452/"},{"reference_url":"https://www.exploit-db.com/exploits/46459","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/46459"},{"reference_url":"https://www.exploit-db.com/exploits/46459/","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:47Z/"}],"url":"https://www.exploit-db.com/exploits/46459/"},{"reference_url":"https://www.exploit-db.com/exploits/46510","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/46510"},{"reference_url":"https://www.exploit-db.com/exploits/46510/","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:47Z/"}],"url":"https://www.exploit-db.com/exploits/46510/"},{"reference_url":"https://www.synology.com/security/advisory/Synology_SA_19_09","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:47Z/"}],"url":"https://www.synology.com/security/advisory/Synology_SA_19_09"},{"reference_url":"http://www.securityfocus.com/bid/107106","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:47Z/"}],"url":"http://www.securityfocus.com/bid/107106"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/remote/46510.rb","reference_id":"CVE-2019-6340","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/remote/46510.rb"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/46452.txt","reference_id":"CVE-2019-6340","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/46452.txt"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/46459.py","reference_id":"CVE-2019-6340","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/46459.py"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6340","reference_id":"CVE-2019-6340","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:P/I:P/A:P"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6340"},{"reference_url":"https://raw.githubusercontent.com/rapid7/metasploit-framework/6ff18828c0273b7170469939a49e4b063d561799/modules/exploits/unix/webapp/drupal_restws_unserialize.rb","reference_id":"CVE-2019-6340","reference_type":"exploit","scores":[],"url":"https://raw.githubusercontent.com/rapid7/metasploit-framework/6ff18828c0273b7170469939a49e4b063d561799/modules/exploits/unix/webapp/drupal_restws_unserialize.rb"},{"reference_url":"https://www.ambionics.io/blog/drupal8-rce","reference_id":"CVE-2019-6340","reference_type":"exploit","scores":[],"url":"https://www.ambionics.io/blog/drupal8-rce"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6340.yaml","reference_id":"CVE-2019-6340.YAML","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6340.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6340.yaml","reference_id":"CVE-2019-6340.YAML","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6340.yaml"},{"reference_url":"https://github.com/advisories/GHSA-3gx6-h57h-rm27","reference_id":"GHSA-3gx6-h57h-rm27","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3gx6-h57h-rm27"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51892?format=json","purl":"pkg:composer/drupal/core@8.5.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.5.11"},{"url":"http://public2.vulnerablecode.io/api/packages/51888?format=json","purl":"pkg:composer/drupal/core@8.6.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.10"}],"aliases":["CVE-2019-6340","GHSA-3gx6-h57h-rm27"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rhj7-dy7q-jkhw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9976?format=json","vulnerability_id":"VCID-rr4q-f5cv-nkah","summary":"URL Redirection to Untrusted Site ('Open Redirect')\nAnonymous Open Redirect in drupal.","references":[{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2018-006"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/32218?format=json","purl":"pkg:composer/drupal/core@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.2"}],"aliases":["2018-10-17-3"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rr4q-f5cv-nkah"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7558?format=json","vulnerability_id":"VCID-sktb-khbq-cuaq","summary":"Incorrect cache context on password reset page\nThe user password reset form does not specify a proper cache context, which can lead to cache poisoning and unwanted content on the page.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-9450","reference_id":"","reference_type":"","scores":[{"value":"0.00227","scoring_system":"epss","scoring_elements":"0.45439","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00227","scoring_system":"epss","scoring_elements":"0.4546","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00227","scoring_system":"epss","scoring_elements":"0.45365","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00227","scoring_system":"epss","scoring_elements":"0.45452","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00227","scoring_system":"epss","scoring_elements":"0.45451","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00227","scoring_system":"epss","scoring_elements":"0.45481","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00227","scoring_system":"epss","scoring_elements":"0.45459","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00227","scoring_system":"epss","scoring_elements":"0.45405","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-9450"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9450.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9450.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9450.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9450.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9450","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9450"},{"reference_url":"https://www.drupal.org/SA-CORE-2016-005","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2016-005"},{"reference_url":"http://www.securityfocus.com/bid/94367","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/94367"},{"reference_url":"https://security.archlinux.org/ASA-201611-20","reference_id":"ASA-201611-20","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-201611-20"},{"reference_url":"https://security.archlinux.org/AVG-74","reference_id":"AVG-74","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-74"},{"reference_url":"https://github.com/advisories/GHSA-98w5-wqp9-w466","reference_id":"GHSA-98w5-wqp9-w466","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-98w5-wqp9-w466"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23294?format=json","purl":"pkg:composer/drupal/core@8.2.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-d4qd-ut89-gbf4"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hpsp-5qtj-v7dq"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-m1ur-bb9m-m7d5"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.2.3"}],"aliases":["CVE-2016-9450","GHSA-98w5-wqp9-w466"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sktb-khbq-cuaq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19319?format=json","vulnerability_id":"VCID-st6v-ch5g-r7h2","summary":"Drupal core Access bypass\nThe Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations.\n\nSolution:\nIf you are using Drupal 8.7.x, you should upgrade to Drupal 8.7.11.\nIf you are using Drupal 8.8.x, you should upgrade to Drupal 8.8.1.\nVersions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage.\n\nAlternatively, you may mitigate this vulnerability by unchecking the \"Enable advanced UI\" checkbox on `/admin/config/media/media-library`. (This mitigation is not available in 8.7.x.)","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2019-12-18-3.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2019-12-18-3.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2019-011","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-011"},{"reference_url":"https://github.com/advisories/GHSA-mh4h-27gq-cxwj","reference_id":"GHSA-mh4h-27gq-cxwj","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mh4h-27gq-cxwj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59955?format=json","purl":"pkg:composer/drupal/core@8.7.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.7.11"},{"url":"http://public2.vulnerablecode.io/api/packages/59956?format=json","purl":"pkg:composer/drupal/core@8.8.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9qyz-jfgb-5yfs"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-agtf-c53h-2fdx"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-mhk6-9qdy-83f3"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-ptxz-rvbt-hqhz"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-rxhd-nkpr-87fm"},{"vulnerability":"VCID-ssyn-dxp9-3kdq"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.1"}],"aliases":["GHSA-mh4h-27gq-cxwj"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-st6v-ch5g-r7h2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22355?format=json","vulnerability_id":"VCID-syrg-ckq7-cbd6","summary":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-13083","reference_id":"","reference_type":"","scores":[{"value":"0.0001","scoring_system":"epss","scoring_elements":"0.01041","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0001","scoring_system":"epss","scoring_elements":"0.01045","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04724","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.0469","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04677","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04736","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04655","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-13083"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"1.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2025-008","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"1.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-18T20:31:33Z/"}],"url":"https://www.drupal.org/sa-core-2025-008"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13083","reference_id":"CVE-2025-13083","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"1.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13083"},{"reference_url":"https://github.com/advisories/GHSA-mhpg-hpj5-73r2","reference_id":"GHSA-mhpg-hpj5-73r2","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mhpg-hpj5-73r2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/64942?format=json","purl":"pkg:composer/drupal/core@10.4.9","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.4.9"},{"url":"http://public2.vulnerablecode.io/api/packages/64943?format=json","purl":"pkg:composer/drupal/core@10.5.6","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.5.6"},{"url":"http://public2.vulnerablecode.io/api/packages/64944?format=json","purl":"pkg:composer/drupal/core@11.1.9","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.1.9"},{"url":"http://public2.vulnerablecode.io/api/packages/64945?format=json","purl":"pkg:composer/drupal/core@11.2.8","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.2.8"}],"aliases":["CVE-2025-13083","GHSA-mhpg-hpj5-73r2"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-syrg-ckq7-cbd6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9966?format=json","vulnerability_id":"VCID-u1xx-aazv-bkg5","summary":"Improper Access Control\nIn some conditions, content moderation fails to check a users access to use certain transitions, leading to an access bypass.","references":[{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2018-006"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/32218?format=json","purl":"pkg:composer/drupal/core@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.2"}],"aliases":["2018-10-17-5"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-u1xx-aazv-bkg5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/15838?format=json","vulnerability_id":"VCID-u4w3-usvb-jyf6","summary":"Drupal Full Path Disclosure\n`core/authorize.php` in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of `hash_salt` is `file_get_contents` of a file that does not exist.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-45440","reference_id":"","reference_type":"","scores":[{"value":"0.86443","scoring_system":"epss","scoring_elements":"0.99404","published_at":"2026-04-02T12:55:00Z"},{"value":"0.86443","scoring_system":"epss","scoring_elements":"0.99405","published_at":"2026-04-04T12:55:00Z"},{"value":"0.87227","scoring_system":"epss","scoring_elements":"0.99449","published_at":"2026-04-13T12:55:00Z"},{"value":"0.87227","scoring_system":"epss","scoring_elements":"0.99448","published_at":"2026-04-11T12:55:00Z"},{"value":"0.87227","scoring_system":"epss","scoring_elements":"0.99447","published_at":"2026-04-09T12:55:00Z"},{"value":"0.87227","scoring_system":"epss","scoring_elements":"0.99445","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-45440"},{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/github/advisory-database/pull/4827","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/github/advisory-database/pull/4827"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45440","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45440"},{"reference_url":"https://senscybersecurity.nl/CVE-2024-45440-Explained","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://senscybersecurity.nl/CVE-2024-45440-Explained"},{"reference_url":"https://www.drupal.org/project/drupal/issues/3457781","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-29T13:18:23Z/"}],"url":"https://www.drupal.org/project/drupal/issues/3457781"},{"reference_url":"https://www.drupal.org/project/drupal/releases/10.2.9","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/project/drupal/releases/10.2.9"},{"reference_url":"https://www.drupal.org/project/drupal/releases/10.3.6","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/project/drupal/releases/10.3.6"},{"reference_url":"https://www.drupal.org/project/drupal/releases/11.0.5","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/project/drupal/releases/11.0.5"},{"reference_url":"https://www.exploit-db.com/exploits/52266","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/52266"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/52266.py","reference_id":"CVE-2024-45440","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/52266.py"},{"reference_url":"https://senscybersecurity.nl/CVE-2024-45440-Explained/","reference_id":"CVE-2024-45440-Explained","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-29T13:18:23Z/"}],"url":"https://senscybersecurity.nl/CVE-2024-45440-Explained/"},{"reference_url":"https://github.com/advisories/GHSA-mg8j-w93w-xjgc","reference_id":"GHSA-mg8j-w93w-xjgc","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mg8j-w93w-xjgc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/55116?format=json","purl":"pkg:composer/drupal/core@10.2.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u2d4-5g3d-zqbt"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.2.9"},{"url":"http://public2.vulnerablecode.io/api/packages/703621?format=json","purl":"pkg:composer/drupal/core@10.3.0-beta1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.3.0-beta1"},{"url":"http://public2.vulnerablecode.io/api/packages/55105?format=json","purl":"pkg:composer/drupal/core@10.3.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.3.6"},{"url":"http://public2.vulnerablecode.io/api/packages/703624?format=json","purl":"pkg:composer/drupal/core@11.0.0-alpha1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.0.0-alpha1"},{"url":"http://public2.vulnerablecode.io/api/packages/55106?format=json","purl":"pkg:composer/drupal/core@11.0.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.0.5"}],"aliases":["CVE-2024-45440","GHSA-mg8j-w93w-xjgc"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-u4w3-usvb-jyf6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/52317?format=json","vulnerability_id":"VCID-ummk-h11z-bkaj","summary":"Twig may load a template outside a configured directory when using the filesystem loader\n# Description\n\nWhen using the filesystem loader to load templates for which the name is a user input, it is possible to use the `source` or `include` statement to read arbitrary files from outside the templates directory when using a namespace like `@somewhere/../some.file` (in such a case, validation is bypassed).\n\n# Resolution\n\nWe fixed validation for such template names.\n\nEven if the 1.x branch is not maintained anymore, a new version has been released.\n\n# Credits\n\nWe would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-39261","reference_id":"","reference_type":"","scores":[{"value":"0.09505","scoring_system":"epss","scoring_elements":"0.92827","published_at":"2026-04-08T12:55:00Z"},{"value":"0.09505","scoring_system":"epss","scoring_elements":"0.92815","published_at":"2026-04-02T12:55:00Z"},{"value":"0.09505","scoring_system":"epss","scoring_elements":"0.92835","published_at":"2026-04-13T12:55:00Z"},{"value":"0.09505","scoring_system":"epss","scoring_elements":"0.92831","published_at":"2026-04-09T12:55:00Z"},{"value":"0.09505","scoring_system":"epss","scoring_elements":"0.9282","published_at":"2026-04-04T12:55:00Z"},{"value":"0.09505","scoring_system":"epss","scoring_elements":"0.92818","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-39261"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39261","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39261"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2022-39261.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2022-39261.yaml"},{"reference_url":"https://github.com/twigphp/Twig","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/twigphp/Twig"},{"reference_url":"https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b"},{"reference_url":"https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00016.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00016.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39261","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39261"},{"reference_url":"https://symfony.com/blog/twig-security-release-possibility-to-load-a-template-outside-a-configured-directory-when-using-the-filesystem-loader","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://symfony.com/blog/twig-security-release-possibility-to-load-a-template-outside-a-configured-directory-when-using-the-filesystem-loader"},{"reference_url":"https://www.debian.org/security/2022/dsa-5248","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://www.debian.org/security/2022/dsa-5248"},{"reference_url":"https://www.drupal.org/sa-core-2022-016","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://www.drupal.org/sa-core-2022-016"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1020991","reference_id":"1020991","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1020991"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/","reference_id":"2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/","reference_id":"AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/"},{"reference_url":"https://github.com/advisories/GHSA-52m2-vc4m-jj33","reference_id":"GHSA-52m2-vc4m-jj33","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-52m2-vc4m-jj33"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/","reference_id":"NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/","reference_id":"TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/"},{"reference_url":"https://usn.ubuntu.com/5947-1/","reference_id":"USN-5947-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5947-1/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/","reference_id":"WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/","reference_id":"YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/370364?format=json","purl":"pkg:composer/drupal/core@9.3.22","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.22"},{"url":"http://public2.vulnerablecode.io/api/packages/313529?format=json","purl":"pkg:composer/drupal/core@9.4.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.4.0-alpha1"},{"url":"http://public2.vulnerablecode.io/api/packages/370368?format=json","purl":"pkg:composer/drupal/core@9.4.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.4.7"},{"url":"http://public2.vulnerablecode.io/api/packages/334373?format=json","purl":"pkg:composer/drupal/core@9.5.0-beta1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.5.0-beta1"}],"aliases":["CVE-2022-39261","GHSA-52m2-vc4m-jj33"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ummk-h11z-bkaj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12881?format=json","vulnerability_id":"VCID-uqcw-p8g2-cfd2","summary":"Exposure of Resource to Wrong Sphere\nInformation Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13670","reference_id":"","reference_type":"","scores":[{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62226","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62313","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62283","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62334","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62355","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62366","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62346","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62329","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62279","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13670"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/f93a37b713b59f8d24e826bc74378099853eef3d","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/f93a37b713b59f8d24e826bc74378099853eef3d"},{"reference_url":"https://www.drupal.org/sa-core-2020-011","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-011"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13670","reference_id":"CVE-2020-13670","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13670"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13670.yaml","reference_id":"CVE-2020-13670.YAML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13670.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13670.yaml","reference_id":"CVE-2020-13670.YAML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13670.yaml"},{"reference_url":"https://github.com/advisories/GHSA-mmjr-5q74-p3m4","reference_id":"GHSA-mmjr-5q74-p3m4","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mmjr-5q74-p3m4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46171?format=json","purl":"pkg:composer/drupal/core@8.8.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.10"},{"url":"http://public2.vulnerablecode.io/api/packages/46146?format=json","purl":"pkg:composer/drupal/core@8.9.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.6"},{"url":"http://public2.vulnerablecode.io/api/packages/46147?format=json","purl":"pkg:composer/drupal/core@9.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.6"}],"aliases":["CVE-2020-13670","GHSA-mmjr-5q74-p3m4"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-uqcw-p8g2-cfd2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35557?format=json","vulnerability_id":"VCID-v9v6-ae3e-g3hk","summary":"Deserialization of Untrusted Data in Archive_Tar\nArchive_Tar through 1.4.10 allows an unserialization attack because `phar:` is blocked but `PHAR:` is not blocked. See: https://github.com/pear/Archive_Tar/issues/33","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-28948.json","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-28948.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-28948","reference_id":"","reference_type":"","scores":[{"value":"0.76218","scoring_system":"epss","scoring_elements":"0.98927","published_at":"2026-04-13T12:55:00Z"},{"value":"0.76218","scoring_system":"epss","scoring_elements":"0.98926","published_at":"2026-04-12T12:55:00Z"},{"value":"0.76218","scoring_system":"epss","scoring_elements":"0.98925","published_at":"2026-04-11T12:55:00Z"},{"value":"0.76218","scoring_system":"epss","scoring_elements":"0.98917","published_at":"2026-04-02T12:55:00Z"},{"value":"0.76218","scoring_system":"epss","scoring_elements":"0.98924","published_at":"2026-04-08T12:55:00Z"},{"value":"0.76218","scoring_system":"epss","scoring_elements":"0.98922","published_at":"2026-04-07T12:55:00Z"},{"value":"0.76218","scoring_system":"epss","scoring_elements":"0.9892","published_at":"2026-04-04T12:55:00Z"},{"value":"0.76218","scoring_system":"epss","scoring_elements":"0.98923","published_at":"2026-04-09T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-28948"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28948","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28948"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28949","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28949"},{"reference_url":"https://github.com/pear/Archive_Tar","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pear/Archive_Tar"},{"reference_url":"https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da"},{"reference_url":"https://github.com/pear/Archive_Tar/issues/33","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pear/Archive_Tar/issues/33"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28948","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28948"},{"reference_url":"https://security.gentoo.org/glsa/202101-23","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202101-23"},{"reference_url":"https://www.debian.org/security/2020/dsa-4817","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2020/dsa-4817"},{"reference_url":"https://www.drupal.org/sa-core-2020-013","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-013"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1904001","reference_id":"1904001","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1904001"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976108","reference_id":"976108","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976108"},{"reference_url":"https://github.com/advisories/GHSA-jh5x-hfhg-78jq","reference_id":"GHSA-jh5x-hfhg-78jq","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-jh5x-hfhg-78jq"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6541","reference_id":"RHSA-2022:6541","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6541"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6542","reference_id":"RHSA-2022:6542","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6542"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:7340","reference_id":"RHSA-2022:7340","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:7340"},{"reference_url":"https://usn.ubuntu.com/4654-1/","reference_id":"USN-4654-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4654-1/"},{"reference_url":"https://usn.ubuntu.com/6981-1/","reference_id":"USN-6981-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6981-1/"},{"reference_url":"https://usn.ubuntu.com/6981-2/","reference_id":"USN-6981-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6981-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60691?format=json","purl":"pkg:composer/drupal/core@8.9.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.10"},{"url":"http://public2.vulnerablecode.io/api/packages/201526?format=json","purl":"pkg:composer/drupal/core@9.0.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.0-alpha1"},{"url":"http://public2.vulnerablecode.io/api/packages/60692?format=json","purl":"pkg:composer/drupal/core@9.0.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.9"},{"url":"http://public2.vulnerablecode.io/api/packages/222401?format=json","purl":"pkg:composer/drupal/core@9.1.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.0-alpha1"}],"aliases":["CVE-2020-28948","GHSA-jh5x-hfhg-78jq"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-v9v6-ae3e-g3hk"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/14839?format=json","vulnerability_id":"VCID-vevm-4sfk-f7gq","summary":"Drupal core Access bypass\nDrupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-55634","reference_id":"","reference_type":"","scores":[{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74805","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74846","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74856","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74877","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74853","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74806","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74833","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74839","published_at":"2026-04-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-55634"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/7ae0e8f1824e15f8b2b06e4da09836250e85e934","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/7ae0e8f1824e15f8b2b06e4da09836250e85e934"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55634","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55634"},{"reference_url":"https://www.drupal.org/sa-core-2024-004","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-12-11T16:38:29Z/"}],"url":"https://www.drupal.org/sa-core-2024-004"},{"reference_url":"https://github.com/advisories/GHSA-7cwc-fjqm-8vh8","reference_id":"GHSA-7cwc-fjqm-8vh8","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7cwc-fjqm-8vh8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51077?format=json","purl":"pkg:composer/drupal/core@10.2.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.2.11"},{"url":"http://public2.vulnerablecode.io/api/packages/51083?format=json","purl":"pkg:composer/drupal/core@10.3.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.3.9"},{"url":"http://public2.vulnerablecode.io/api/packages/51156?format=json","purl":"pkg:composer/drupal/core@11.0.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.0.8"}],"aliases":["CVE-2024-55634","GHSA-7cwc-fjqm-8vh8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vevm-4sfk-f7gq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/25429?format=json","vulnerability_id":"VCID-vrdx-165p-efda","summary":"Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages\nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-3057","reference_id":"","reference_type":"","scores":[{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61074","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61028","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61056","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61022","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.6107","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61086","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61107","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61093","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-3057"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3057","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3057"},{"reference_url":"https://www.drupal.org/sa-core-2025-001","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-01T13:26:50Z/"}],"url":"https://www.drupal.org/sa-core-2025-001"},{"reference_url":"https://github.com/advisories/GHSA-39g6-x4x8-5jcm","reference_id":"GHSA-39g6-x4x8-5jcm","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-39g6-x4x8-5jcm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/68503?format=json","purl":"pkg:composer/drupal/core@10.3.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.3.13"},{"url":"http://public2.vulnerablecode.io/api/packages/68504?format=json","purl":"pkg:composer/drupal/core@10.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.4.3"},{"url":"http://public2.vulnerablecode.io/api/packages/68505?format=json","purl":"pkg:composer/drupal/core@11.0.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.0.12"},{"url":"http://public2.vulnerablecode.io/api/packages/68506?format=json","purl":"pkg:composer/drupal/core@11.1.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-syrg-ckq7-cbd6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@11.1.3"}],"aliases":["CVE-2025-3057","GHSA-39g6-x4x8-5jcm"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vrdx-165p-efda"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7560?format=json","vulnerability_id":"VCID-vy1y-zkf3-4ue4","summary":"Denial of service via transliterate mechanism\nA specially crafted URL can cause a denial of service via the transliterate mechanism.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-9452","reference_id":"","reference_type":"","scores":[{"value":"0.00378","scoring_system":"epss","scoring_elements":"0.59319","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00378","scoring_system":"epss","scoring_elements":"0.59356","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00378","scoring_system":"epss","scoring_elements":"0.59374","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00378","scoring_system":"epss","scoring_elements":"0.5939","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00378","scoring_system":"epss","scoring_elements":"0.59371","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00378","scoring_system":"epss","scoring_elements":"0.59358","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00378","scoring_system":"epss","scoring_elements":"0.59307","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00378","scoring_system":"epss","scoring_elements":"0.59343","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00378","scoring_system":"epss","scoring_elements":"0.59245","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-9452"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9452.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9452.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9452.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9452.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9452","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9452"},{"reference_url":"https://www.drupal.org/SA-CORE-2016-005","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2016-005"},{"reference_url":"http://www.securityfocus.com/bid/94367","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/94367"},{"reference_url":"https://security.archlinux.org/ASA-201611-20","reference_id":"ASA-201611-20","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-201611-20"},{"reference_url":"https://security.archlinux.org/AVG-74","reference_id":"AVG-74","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-74"},{"reference_url":"https://github.com/advisories/GHSA-jpj8-49hr-wcwv","reference_id":"GHSA-jpj8-49hr-wcwv","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-jpj8-49hr-wcwv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23294?format=json","purl":"pkg:composer/drupal/core@8.2.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-d4qd-ut89-gbf4"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hpsp-5qtj-v7dq"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-m1ur-bb9m-m7d5"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.2.3"}],"aliases":["CVE-2016-9452","GHSA-jpj8-49hr-wcwv"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vy1y-zkf3-4ue4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12883?format=json","vulnerability_id":"VCID-w6cz-mg4v-3udj","summary":"Drupal core access bypass vulnerability\nUnder some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13677","reference_id":"","reference_type":"","scores":[{"value":"0.00198","scoring_system":"epss","scoring_elements":"0.41888","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00198","scoring_system":"epss","scoring_elements":"0.41832","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00198","scoring_system":"epss","scoring_elements":"0.41898","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00198","scoring_system":"epss","scoring_elements":"0.41926","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00198","scoring_system":"epss","scoring_elements":"0.41853","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00198","scoring_system":"epss","scoring_elements":"0.41903","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00198","scoring_system":"epss","scoring_elements":"0.41913","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00198","scoring_system":"epss","scoring_elements":"0.41937","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00198","scoring_system":"epss","scoring_elements":"0.41902","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13677"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/7a9bef4b4750d79ab42498e459012cabe4c4bd8b","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/7a9bef4b4750d79ab42498e459012cabe4c4bd8b"},{"reference_url":"https://www.drupal.org/sa-core-2021-010","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2021-010"},{"reference_url":"https://security.archlinux.org/AVG-2407","reference_id":"AVG-2407","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-2407"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13677","reference_id":"CVE-2020-13677","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13677"},{"reference_url":"https://github.com/advisories/GHSA-3xr3-phjp-g6p2","reference_id":"GHSA-3xr3-phjp-g6p2","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3xr3-phjp-g6p2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46155?format=json","purl":"pkg:composer/drupal/core@8.9.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.19"},{"url":"http://public2.vulnerablecode.io/api/packages/46118?format=json","purl":"pkg:composer/drupal/core@9.1.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.13"},{"url":"http://public2.vulnerablecode.io/api/packages/46119?format=json","purl":"pkg:composer/drupal/core@9.2.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-674z-nf4t-b7ez"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-b4yh-gyrx-3yhh"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-zw3u-6ue7-efdf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.2.6"}],"aliases":["CVE-2020-13677","GHSA-3xr3-phjp-g6p2"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-w6cz-mg4v-3udj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19389?format=json","vulnerability_id":"VCID-wabj-ty5p-pfd6","summary":"Drupal core Remote Code Execution\nIn Drupal core, when sending email some variables were not being sanitized for shell arguments in `DefaultMailSystem::mail()`, which could lead to remote code execution.","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2018-10-17-4.yaml","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2018-10-17-4.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-006"},{"reference_url":"https://github.com/advisories/GHSA-6mgp-v5cm-ghg5","reference_id":"GHSA-6mgp-v5cm-ghg5","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6mgp-v5cm-ghg5"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60240?format=json","purl":"pkg:composer/drupal/core@8.5.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.5.8"},{"url":"http://public2.vulnerablecode.io/api/packages/32218?format=json","purl":"pkg:composer/drupal/core@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.2"}],"aliases":["GHSA-6mgp-v5cm-ghg5"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wabj-ty5p-pfd6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/13472?format=json","vulnerability_id":"VCID-wbuz-qcp3-43aq","summary":"Improper Input Validation\nguzzlehttp/psr7 is a PSR-7 HTTP message library used in drupal. Versions prior to 1.8.4 and 2.1.1 is vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24775","reference_id":"","reference_type":"","scores":[{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.76084","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.7614","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.76143","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.76167","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.76142","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.76128","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.76095","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.76116","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24775"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24775","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24775"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2022-24775.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2022-24775.yaml"},{"reference_url":"https://github.com/guzzle/psr7","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/guzzle/psr7"},{"reference_url":"https://github.com/guzzle/psr7/pull/485/commits/e55afaa3fc138c89adf3b55a8ba20dc60d17f1f1","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:56:31Z/"}],"url":"https://github.com/guzzle/psr7/pull/485/commits/e55afaa3fc138c89adf3b55a8ba20dc60d17f1f1"},{"reference_url":"https://github.com/guzzle/psr7/pull/486/commits/9a96d9db668b485361ed9de7b5bf1e54895df1dc","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:56:31Z/"}],"url":"https://github.com/guzzle/psr7/pull/486/commits/9a96d9db668b485361ed9de7b5bf1e54895df1dc"},{"reference_url":"https://www.drupal.org/sa-core-2022-006","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:56:31Z/"}],"url":"https://www.drupal.org/sa-core-2022-006"},{"reference_url":"https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008236","reference_id":"1008236","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008236"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24775","reference_id":"CVE-2022-24775","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24775"},{"reference_url":"https://github.com/advisories/GHSA-q7rv-6hp3-vh96","reference_id":"GHSA-q7rv-6hp3-vh96","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-q7rv-6hp3-vh96"},{"reference_url":"https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96","reference_id":"GHSA-q7rv-6hp3-vh96","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:56:31Z/"}],"url":"https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96"},{"reference_url":"https://usn.ubuntu.com/6670-1/","reference_id":"USN-6670-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6670-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/47990?format=json","purl":"pkg:composer/drupal/core@9.2.16","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-674z-nf4t-b7ez"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.2.16"},{"url":"http://public2.vulnerablecode.io/api/packages/289902?format=json","purl":"pkg:composer/drupal/core@9.3.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.0-alpha1"},{"url":"http://public2.vulnerablecode.io/api/packages/47991?format=json","purl":"pkg:composer/drupal/core@9.3.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-1qgc-gjdn-9fhk"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-674z-nf4t-b7ez"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.9"},{"url":"http://public2.vulnerablecode.io/api/packages/289905?format=json","purl":"pkg:composer/drupal/core@10.0.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.0.0-alpha1"}],"aliases":["CVE-2022-24775","GHSA-q7rv-6hp3-vh96"],"risk_score":3.4,"exploitability":"0.5","weighted_severity":"6.8","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wbuz-qcp3-43aq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12885?format=json","vulnerability_id":"VCID-ww44-hb2y-mfd5","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nAccess Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13668","reference_id":"","reference_type":"","scores":[{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44824","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44927","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44907","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44913","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44911","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44943","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44922","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.4492","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44868","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13668"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/3184fa4b2f3b65b44884b5e858cdc7794d34b4c8","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/3184fa4b2f3b65b44884b5e858cdc7794d34b4c8"},{"reference_url":"https://github.com/drupal/core/commit/58330ba58d1ac6f1a0a549e8dbde8a3e094bf4fb","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/58330ba58d1ac6f1a0a549e8dbde8a3e094bf4fb"},{"reference_url":"https://github.com/drupal/core/commit/d4be028d81fb6b067513d788b60c3e6fc8fbd0a2","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/d4be028d81fb6b067513d788b60c3e6fc8fbd0a2"},{"reference_url":"https://www.drupal.org/sa-core-2020-009","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-009"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13668","reference_id":"CVE-2020-13668","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13668"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13668.yaml","reference_id":"CVE-2020-13668.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13668.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13668.yaml","reference_id":"CVE-2020-13668.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13668.yaml"},{"reference_url":"https://github.com/advisories/GHSA-m6q5-wv4x-fv6h","reference_id":"GHSA-m6q5-wv4x-fv6h","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-m6q5-wv4x-fv6h"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46171?format=json","purl":"pkg:composer/drupal/core@8.8.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.10"},{"url":"http://public2.vulnerablecode.io/api/packages/46146?format=json","purl":"pkg:composer/drupal/core@8.9.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.6"},{"url":"http://public2.vulnerablecode.io/api/packages/46147?format=json","purl":"pkg:composer/drupal/core@9.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.6"}],"aliases":["CVE-2020-13668","GHSA-m6q5-wv4x-fv6h"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ww44-hb2y-mfd5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12831?format=json","vulnerability_id":"VCID-wwvq-399y-rfhc","summary":"Drupal Core Remote Code Execution Vulnerability\nA remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-7602","reference_id":"","reference_type":"","scores":[{"value":"0.94385","scoring_system":"epss","scoring_elements":"0.9997","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-7602"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7602","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7602"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7602.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7602.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7602.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7602.yaml"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:39:15Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7602","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7602"},{"reference_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602"},{"reference_url":"https://www.debian.org/security/2018/dsa-4180","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:39:15Z/"}],"url":"https://www.debian.org/security/2018/dsa-4180"},{"reference_url":"https://www.drupal.org/sa-core-2018-004","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:39:15Z/"}],"url":"https://www.drupal.org/sa-core-2018-004"},{"reference_url":"https://www.exploit-db.com/exploits/44542","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/44542"},{"reference_url":"https://www.exploit-db.com/exploits/44542/","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:39:15Z/"}],"url":"https://www.exploit-db.com/exploits/44542/"},{"reference_url":"https://www.exploit-db.com/exploits/44557","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/44557"},{"reference_url":"https://www.exploit-db.com/exploits/44557/","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:39:15Z/"}],"url":"https://www.exploit-db.com/exploits/44557/"},{"reference_url":"http://www.securityfocus.com/bid/103985","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:39:15Z/"}],"url":"http://www.securityfocus.com/bid/103985"},{"reference_url":"http://www.securitytracker.com/id/1040754","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:39:15Z/"}],"url":"http://www.securitytracker.com/id/1040754"},{"reference_url":"https://security.archlinux.org/ASA-201804-10","reference_id":"ASA-201804-10","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-201804-10"},{"reference_url":"https://security.archlinux.org/AVG-679","reference_id":"AVG-679","reference_type":"","scores":[{"value":"Critical","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-679"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/44557.rb","reference_id":"CVE-2018-7602","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/44557.rb"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/44542.txt","reference_id":"CVE-2018-7602;SA-CORE-2018-004","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/44542.txt"},{"reference_url":"https://pastebin.com/pRM8nmwj","reference_id":"CVE-2018-7602;SA-CORE-2018-004","reference_type":"exploit","scores":[],"url":"https://pastebin.com/pRM8nmwj"},{"reference_url":"https://github.com/advisories/GHSA-297x-j9pm-xjgg","reference_id":"GHSA-297x-j9pm-xjgg","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-297x-j9pm-xjgg"},{"reference_url":"https://usn.ubuntu.com/USN-4773-1/","reference_id":"USN-USN-4773-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/USN-4773-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46012?format=json","purl":"pkg:composer/drupal/core@8.4.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.4.8"},{"url":"http://public2.vulnerablecode.io/api/packages/46013?format=json","purl":"pkg:composer/drupal/core@8.5.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.5.3"}],"aliases":["CVE-2018-7602","GHSA-297x-j9pm-xjgg"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wwvq-399y-rfhc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19393?format=json","vulnerability_id":"VCID-wzgs-fr3u-cbdn","summary":"Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar\nThe Drupal project uses the third-party library [Archive_Tar](https://pear.php.net/package/Archive_Tar/), which has released a security improvement that is needed to protect some Drupal configurations.\n\nMultiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and processes them.\n\nThe latest versions of Drupal update Archive_Tar to 1.4.9 to mitigate the file processing vulnerabilities.","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2019-12-18-4.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2019-12-18-4.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2019-012","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-012"},{"reference_url":"https://github.com/advisories/GHSA-98h9-727m-44qv","reference_id":"GHSA-98h9-727m-44qv","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-98h9-727m-44qv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59955?format=json","purl":"pkg:composer/drupal/core@8.7.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.7.11"},{"url":"http://public2.vulnerablecode.io/api/packages/59956?format=json","purl":"pkg:composer/drupal/core@8.8.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-16ns-uqh5-d3gh"},{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-9qyz-jfgb-5yfs"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-agtf-c53h-2fdx"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-mhk6-9qdy-83f3"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-ptxz-rvbt-hqhz"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-rxhd-nkpr-87fm"},{"vulnerability":"VCID-ssyn-dxp9-3kdq"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.1"}],"aliases":["GHSA-98h9-727m-44qv"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wzgs-fr3u-cbdn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19843?format=json","vulnerability_id":"VCID-x2as-f9fx-9kff","summary":"Drupal Anonymous Open Redirect\nDrupal core and contributed modules frequently use a \"destination\" query string parameter in URLs to redirect users to a new destination after completing an action on the current page. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks.","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"5.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2018-10-17-3.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2018-10-17-3.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[{"value":"5.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-006"},{"reference_url":"https://github.com/advisories/GHSA-gfvf-2f25-f34r","reference_id":"GHSA-gfvf-2f25-f34r","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gfvf-2f25-f34r"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60240?format=json","purl":"pkg:composer/drupal/core@8.5.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.5.8"},{"url":"http://public2.vulnerablecode.io/api/packages/32218?format=json","purl":"pkg:composer/drupal/core@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3s9f-prpy-hbcx"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.6.2"}],"aliases":["GHSA-gfvf-2f25-f34r"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-x2as-f9fx-9kff"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7884?format=json","vulnerability_id":"VCID-y74s-ghyc-2bhs","summary":"Access Bypass\nThis is a critical access bypass vulnerability in Drupal.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6919","reference_id":"","reference_type":"","scores":[{"value":"0.00598","scoring_system":"epss","scoring_elements":"0.6933","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00598","scoring_system":"epss","scoring_elements":"0.69386","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00598","scoring_system":"epss","scoring_elements":"0.694","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00598","scoring_system":"epss","scoring_elements":"0.69416","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00598","scoring_system":"epss","scoring_elements":"0.69393","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00598","scoring_system":"epss","scoring_elements":"0.69377","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00598","scoring_system":"epss","scoring_elements":"0.69327","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00598","scoring_system":"epss","scoring_elements":"0.69347","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00598","scoring_system":"epss","scoring_elements":"0.69318","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6919"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6919.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6919.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6919.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6919.yaml"},{"reference_url":"https://groups.drupal.org/node/516645","reference_id":"","reference_type":"","scores":[],"url":"https://groups.drupal.org/node/516645"},{"reference_url":"https://www.drupal.org/SA-2017-002","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-2017-002"},{"reference_url":"https://www.drupal.org/SA-CORE-2017-002","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2017-002"},{"reference_url":"http://www.securityfocus.com/bid/97941","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/97941"},{"reference_url":"http://www.securitytracker.com/id/1038371","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securitytracker.com/id/1038371"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha10:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha10:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha10:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha11:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha11:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha11:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha12:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha12:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha12:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha13:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha13:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha13:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha14:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha14:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha14:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha15:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha15:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha15:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha3:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha3:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha3:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha4:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha4:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha4:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha5:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha5:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha5:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha6:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha6:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha6:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha7:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha7:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha7:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha8:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha8:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha8:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha9:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:alpha9:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:alpha9:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta10:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta10:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta10:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta11:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta11:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta11:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta12:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta12:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta12:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta13:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta13:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta13:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta14:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta14:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta14:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta15:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta15:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta15:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta16:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta16:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta16:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta3:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta3:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta3:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta4:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta4:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta4:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta6:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta6:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta6:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta7:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta7:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta7:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta9:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:beta9:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:beta9:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:rc1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:rc2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc3:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:rc3:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc3:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc4:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.0:rc4:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.0:rc4:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.0.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.0.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:beta1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.0:beta1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:beta1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:beta2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.0:beta2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:beta2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:rc1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.0:rc1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.0:rc1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.10:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.10:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.10:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.7:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.7:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.7:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.8:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.8:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.8:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.9:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.1.9:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.1.9:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.7:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.2.7:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.2.7:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.3.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.3.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.3.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.3.0:alpha1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.3.0:alpha1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.3.0:alpha1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.3.0:beta1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.3.0:beta1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.3.0:beta1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.3.0:rc1:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.3.0:rc1:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.3.0:rc1:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.3.0:rc2:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:8.3.0:rc2:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:8.3.0:rc2:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6919","reference_id":"CVE-2017-6919","reference_type":"","scores":[{"value":"6.0","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:S/C:P/I:P/A:P"},{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6919"},{"reference_url":"https://github.com/advisories/GHSA-6hpj-9xj7-2jxx","reference_id":"GHSA-6hpj-9xj7-2jxx","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6hpj-9xj7-2jxx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/24096?format=json","purl":"pkg:composer/drupal/core@8.2.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.2.8"},{"url":"http://public2.vulnerablecode.io/api/packages/24097?format=json","purl":"pkg:composer/drupal/core@8.3.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-yare-57j9-j7cs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.3.1"}],"aliases":["CVE-2017-6919","GHSA-6hpj-9xj7-2jxx"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-y74s-ghyc-2bhs"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8834?format=json","vulnerability_id":"VCID-yare-57j9-j7cs","summary":"URL Redirection to Untrusted Site (Open Redirect)\nDrupal core has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an external site.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6932","reference_id":"","reference_type":"","scores":[{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.595","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.59614","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.59634","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.5965","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.59631","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.59618","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.59567","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.59598","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.59573","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6932"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6932.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6932.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6932.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6932.yaml"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6932","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6932"},{"reference_url":"https://www.debian.org/security/2018/dsa-4123","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2018/dsa-4123"},{"reference_url":"https://www.drupal.org/sa-core-2018-001","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-001"},{"reference_url":"https://www.drupal.org/SA-CORE-2018-001","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2018-001"},{"reference_url":"https://github.com/advisories/GHSA-wm86-w3cf-h6vm","reference_id":"GHSA-wm86-w3cf-h6vm","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wm86-w3cf-h6vm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26566?format=json","purl":"pkg:composer/drupal/core@8.4.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.4.5"}],"aliases":["CVE-2017-6932","GHSA-wm86-w3cf-h6vm"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-yare-57j9-j7cs"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10234?format=json","vulnerability_id":"VCID-ymka-jfep-87gt","summary":"Missing Authorization\nWhen creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view. It is best practice to always include some form of access restrictions on all views, even if you are using another module to display them.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6923","reference_id":"","reference_type":"","scores":[{"value":"0.00714","scoring_system":"epss","scoring_elements":"0.72279","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00714","scoring_system":"epss","scoring_elements":"0.72326","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00714","scoring_system":"epss","scoring_elements":"0.72338","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00714","scoring_system":"epss","scoring_elements":"0.72354","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00714","scoring_system":"epss","scoring_elements":"0.72331","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00714","scoring_system":"epss","scoring_elements":"0.72319","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00714","scoring_system":"epss","scoring_elements":"0.7228","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00714","scoring_system":"epss","scoring_elements":"0.72304","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00714","scoring_system":"epss","scoring_elements":"0.72285","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6923"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6923.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6923.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6923.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6923.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6923","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:S/C:P/I:N/A:N"},{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6923"},{"reference_url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple"},{"reference_url":"https://www.drupal.org/SA-CORE-2017-004","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2017-004"},{"reference_url":"http://www.securityfocus.com/bid/100368","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/100368"},{"reference_url":"http://www.securitytracker.com/id/1039200","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securitytracker.com/id/1039200"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://github.com/advisories/GHSA-v3f6-f29f-rgvp","reference_id":"GHSA-v3f6-f29f-rgvp","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v3f6-f29f-rgvp"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/34584?format=json","purl":"pkg:composer/drupal/core@8.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.3.0"},{"url":"http://public2.vulnerablecode.io/api/packages/34582?format=json","purl":"pkg:composer/drupal/core@8.3.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-yare-57j9-j7cs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.3.7"}],"aliases":["CVE-2017-6923","GHSA-v3f6-f29f-rgvp"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ymka-jfep-87gt"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7557?format=json","vulnerability_id":"VCID-yrzt-3m97-53ce","summary":"Unprivileged access to taxonomy terms\nModules wishing to restrict access to taxonomy terms may be incompatible with queries generated both by Drupal core as well as those generated by contributed modules like Entity Reference. As a result, information on taxonomy terms may be disclosed to unprivileged users.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-9449","reference_id":"","reference_type":"","scores":[{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.44037","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.44011","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.44027","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.44045","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.4406","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.43989","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.44042","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00215","scoring_system":"epss","scoring_elements":"0.43991","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-9449"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9449","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9449"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9451","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9451"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9449.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9449.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9449.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9449.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9449","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9449"},{"reference_url":"https://www.drupal.org/SA-CORE-2016-005","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2016-005"},{"reference_url":"http://www.debian.org/security/2016/dsa-3718","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.debian.org/security/2016/dsa-3718"},{"reference_url":"http://www.securityfocus.com/bid/94367","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/94367"},{"reference_url":"https://security.archlinux.org/ASA-201611-20","reference_id":"ASA-201611-20","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-201611-20"},{"reference_url":"https://security.archlinux.org/AVG-74","reference_id":"AVG-74","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-74"},{"reference_url":"https://github.com/advisories/GHSA-p745-347h-hjfw","reference_id":"GHSA-p745-347h-hjfw","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p745-347h-hjfw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23294?format=json","purl":"pkg:composer/drupal/core@8.2.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-d4qd-ut89-gbf4"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hpsp-5qtj-v7dq"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-m1ur-bb9m-m7d5"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.2.3"}],"aliases":["CVE-2016-9449","GHSA-p745-347h-hjfw"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-yrzt-3m97-53ce"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7514?format=json","vulnerability_id":"VCID-yty5-zn46-r3dj","summary":"Unprivileged access to \"Administer comments\"\nUsers who have rights to edit a node can set the visibility on comments for that node. This should be restricted to those who have the administer comments permission.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7570","reference_id":"","reference_type":"","scores":[{"value":"0.00345","scoring_system":"epss","scoring_elements":"0.57006","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00345","scoring_system":"epss","scoring_elements":"0.57143","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00345","scoring_system":"epss","scoring_elements":"0.57164","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00345","scoring_system":"epss","scoring_elements":"0.57152","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00345","scoring_system":"epss","scoring_elements":"0.5715","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00345","scoring_system":"epss","scoring_elements":"0.57099","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00345","scoring_system":"epss","scoring_elements":"0.57123","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00345","scoring_system":"epss","scoring_elements":"0.571","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7570"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7570.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7570.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7570.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7570.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7570","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7570"},{"reference_url":"https://www.drupal.org/SA-CORE-2016-004","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2016-004"},{"reference_url":"http://www.securityfocus.com/bid/93101","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/93101"},{"reference_url":"http://www.securitytracker.com/id/1036886","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securitytracker.com/id/1036886"},{"reference_url":"https://github.com/advisories/GHSA-6g9h-6v79-w4pc","reference_id":"GHSA-6g9h-6v79-w4pc","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6g9h-6v79-w4pc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23184?format=json","purl":"pkg:composer/drupal/core@8.1.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-d4qd-ut89-gbf4"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hpsp-5qtj-v7dq"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-m1ur-bb9m-m7d5"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-sktb-khbq-cuaq"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-vy1y-zkf3-4ue4"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"},{"vulnerability":"VCID-yrzt-3m97-53ce"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.1.10"}],"aliases":["CVE-2016-7570","GHSA-6g9h-6v79-w4pc"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-yty5-zn46-r3dj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7442?format=json","vulnerability_id":"VCID-zawz-vky5-tkgt","summary":"Improper Access Control\nPHP does not attempt to address RFC section namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the `HTTP_PROXY` environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an `httpoxy` issue.","references":[{"reference_url":"http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html","reference_id":"","reference_type":"","scores":[],"url":"http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2016-1609.html","reference_id":"","reference_type":"","scores":[],"url":"http://rhn.redhat.com/errata/RHSA-2016-1609.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2016-1610.html","reference_id":"","reference_type":"","scores":[],"url":"http://rhn.redhat.com/errata/RHSA-2016-1610.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2016-1611.html","reference_id":"","reference_type":"","scores":[],"url":"http://rhn.redhat.com/errata/RHSA-2016-1611.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2016-1612.html","reference_id":"","reference_type":"","scores":[],"url":"http://rhn.redhat.com/errata/RHSA-2016-1612.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2016-1613.html","reference_id":"","reference_type":"","scores":[],"url":"http://rhn.redhat.com/errata/RHSA-2016-1613.html"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-5385.json","reference_id":"","reference_type":"","scores":[{"value":"5.0","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-5385.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-5385","reference_id":"","reference_type":"","scores":[{"value":"0.81346","scoring_system":"epss","scoring_elements":"0.99162","published_at":"2026-04-01T12:55:00Z"},{"value":"0.81346","scoring_system":"epss","scoring_elements":"0.9917","published_at":"2026-04-12T12:55:00Z"},{"value":"0.81346","scoring_system":"epss","scoring_elements":"0.99168","published_at":"2026-04-07T12:55:00Z"},{"value":"0.81346","scoring_system":"epss","scoring_elements":"0.99169","published_at":"2026-04-13T12:55:00Z"},{"value":"0.81346","scoring_system":"epss","scoring_elements":"0.99163","published_at":"2026-04-02T12:55:00Z"},{"value":"0.81346","scoring_system":"epss","scoring_elements":"0.99165","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-5385"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1353794","reference_id":"","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1353794"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5385","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5385"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5399","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5399"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6289","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6289"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6290","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6290"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6291","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6291"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6292","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6292"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6294","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6294"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6295","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6295"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6296","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6296"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6297","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6297"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:N/C:N/I:P/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/amphp/artax/commit/81254742812a5a9adf4b085f543f3f21daedcd97","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/amphp/artax/commit/81254742812a5a9adf4b085f543f3f21daedcd97"},{"reference_url":"https://github.com/amphp/artax/commit/b60cf493c9e577a3678865f620b1eb61ab3d7ca9","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/amphp/artax/commit/b60cf493c9e577a3678865f620b1eb61ab3d7ca9"},{"reference_url":"https://github.com/bugsnag/bugsnag-laravel/pull/143","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/bugsnag/bugsnag-laravel/pull/143"},{"reference_url":"https://github.com/bugsnag/bugsnag-laravel/pull/145","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/bugsnag/bugsnag-laravel/pull/145"},{"reference_url":"https://github.com/bugsnag/bugsnag-laravel/releases/tag/v2.0.2","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/bugsnag/bugsnag-laravel/releases/tag/v2.0.2"},{"reference_url":"https://github.com/guzzle/guzzle/blob/4.x/CHANGELOG.md#424-2016-07-18","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/guzzle/guzzle/blob/4.x/CHANGELOG.md#424-2016-07-18"},{"reference_url":"https://github.com/guzzle/guzzle/blob/5.3/CHANGELOG.md#531---2016-07-18","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/guzzle/guzzle/blob/5.3/CHANGELOG.md#531---2016-07-18"},{"reference_url":"https://github.com/guzzle/guzzle/blob/master/CHANGELOG.md#622---2016-10-08","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/guzzle/guzzle/blob/master/CHANGELOG.md#622---2016-10-08"},{"reference_url":"https://github.com/guzzle/guzzle/releases/tag/6.2.1","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/guzzle/guzzle/releases/tag/6.2.1"},{"reference_url":"https://github.com/humbug/file_get_contents/pull/23","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/humbug/file_get_contents/pull/23"},{"reference_url":"https://github.com/humbug/file_get_contents/pull/23/commits/848e8c282a863654e76bd958acfb57c81cb739b5","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/humbug/file_get_contents/pull/23/commits/848e8c282a863654e76bd958acfb57c81cb739b5"},{"reference_url":"https://github.com/humbug/file_get_contents/releases/tag/1.1.2","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/humbug/file_get_contents/releases/tag/1.1.2"},{"reference_url":"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us","reference_id":"","reference_type":"","scores":[],"url":"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us"},{"reference_url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149","reference_id":"","reference_type":"","scores":[],"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149"},{"reference_url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297","reference_id":"","reference_type":"","scores":[],"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297"},{"reference_url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","reference_id":"","reference_type":"","scores":[],"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722"},{"reference_url":"https://httpoxy.org/","reference_id":"","reference_type":"","scores":[],"url":"https://httpoxy.org/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/"},{"reference_url":"https://security.gentoo.org/glsa/201611-22","reference_id":"","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201611-22"},{"reference_url":"https://twitter.com/asyncphp/status/755136084917583872","reference_id":"","reference_type":"","scores":[],"url":"https://twitter.com/asyncphp/status/755136084917583872"},{"reference_url":"https://typo3.org/security/advisory/typo3-core-sa-2016-019","reference_id":"","reference_type":"","scores":[],"url":"https://typo3.org/security/advisory/typo3-core-sa-2016-019"},{"reference_url":"https://www.drupal.org/SA-CORE-2016-003","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2016-003"},{"reference_url":"http://www.debian.org/security/2016/dsa-3631","reference_id":"","reference_type":"","scores":[],"url":"http://www.debian.org/security/2016/dsa-3631"},{"reference_url":"http://www.kb.cert.org/vuls/id/797896","reference_id":"","reference_type":"","scores":[],"url":"http://www.kb.cert.org/vuls/id/797896"},{"reference_url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","reference_id":"","reference_type":"","scores":[],"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"},{"reference_url":"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","reference_id":"","reference_type":"","scores":[],"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html","reference_id":"","reference_type":"","scores":[],"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"},{"reference_url":"http://www.securityfocus.com/bid/91821","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/91821"},{"reference_url":"http://www.securitytracker.com/id/1036335","reference_id":"","reference_type":"","scores":[],"url":"http://www.securitytracker.com/id/1036335"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5385","reference_id":"CVE-2016-5385","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5385"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/amphp/artax/CVE-2016-5385.yaml","reference_id":"CVE-2016-5385.YAML","reference_type":"","scores":[],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/amphp/artax/CVE-2016-5385.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/bugsnag/bugsnag-laravel/CVE-2016-5385.yaml","reference_id":"CVE-2016-5385.YAML","reference_type":"","scores":[],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/bugsnag/bugsnag-laravel/CVE-2016-5385.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-5385.yaml","reference_id":"CVE-2016-5385.YAML","reference_type":"","scores":[],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-5385.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-5385.yaml","reference_id":"CVE-2016-5385.YAML","reference_type":"","scores":[],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-5385.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2016-5385.yaml","reference_id":"CVE-2016-5385.YAML","reference_type":"","scores":[],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2016-5385.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/padraic/humbug_get_contents/CVE-2016-5385.yaml","reference_id":"CVE-2016-5385.YAML","reference_type":"","scores":[],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/padraic/humbug_get_contents/CVE-2016-5385.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2016-5385.yaml","reference_id":"CVE-2016-5385.YAML","reference_type":"","scores":[],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2016-5385.yaml"},{"reference_url":"https://github.com/advisories/GHSA-m6ch-gg5f-wxx3","reference_id":"GHSA-m6ch-gg5f-wxx3","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-m6ch-gg5f-wxx3"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:1609","reference_id":"RHSA-2016:1609","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:1609"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:1610","reference_id":"RHSA-2016:1610","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:1610"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:1611","reference_id":"RHSA-2016:1611","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:1611"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:1612","reference_id":"RHSA-2016:1612","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:1612"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:1613","reference_id":"RHSA-2016:1613","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:1613"},{"reference_url":"https://usn.ubuntu.com/3045-1/","reference_id":"USN-3045-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3045-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22707?format=json","purl":"pkg:composer/drupal/core@8.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-4wwt-vt76-dbe1"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-d4qd-ut89-gbf4"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hpsp-5qtj-v7dq"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-m1ur-bb9m-m7d5"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-sktb-khbq-cuaq"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-vy1y-zkf3-4ue4"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"},{"vulnerability":"VCID-yrzt-3m97-53ce"},{"vulnerability":"VCID-yty5-zn46-r3dj"},{"vulnerability":"VCID-zvtp-4we3-qygx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.1.0"},{"url":"http://public2.vulnerablecode.io/api/packages/143341?format=json","purl":"pkg:composer/drupal/core@8.1.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-4wwt-vt76-dbe1"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-d4qd-ut89-gbf4"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hpsp-5qtj-v7dq"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-m1ur-bb9m-m7d5"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-sktb-khbq-cuaq"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-vy1y-zkf3-4ue4"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"},{"vulnerability":"VCID-yrzt-3m97-53ce"},{"vulnerability":"VCID-yty5-zn46-r3dj"},{"vulnerability":"VCID-zvtp-4we3-qygx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.1.7"}],"aliases":["CVE-2016-5385","GHSA-m6ch-gg5f-wxx3"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zawz-vky5-tkgt"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7517?format=json","vulnerability_id":"VCID-zvtp-4we3-qygx","summary":"Unprivileged access to config export\nThe `system.temporary` route allows the download of a full config export. The full config export should be limited to those with \"Export configuration\" permission.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7572","reference_id":"","reference_type":"","scores":[{"value":"0.00252","scoring_system":"epss","scoring_elements":"0.48545","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00252","scoring_system":"epss","scoring_elements":"0.48577","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00252","scoring_system":"epss","scoring_elements":"0.48564","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00252","scoring_system":"epss","scoring_elements":"0.48591","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00252","scoring_system":"epss","scoring_elements":"0.48568","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00252","scoring_system":"epss","scoring_elements":"0.4851","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00252","scoring_system":"epss","scoring_elements":"0.4857","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00252","scoring_system":"epss","scoring_elements":"0.48574","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00252","scoring_system":"epss","scoring_elements":"0.4852","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-7572"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7572.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7572.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7572.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7572.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7572","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7572"},{"reference_url":"https://www.drupal.org/SA-CORE-2016-004","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2016-004"},{"reference_url":"http://www.securityfocus.com/bid/93101","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/93101"},{"reference_url":"http://www.securitytracker.com/id/1036886","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securitytracker.com/id/1036886"},{"reference_url":"https://github.com/advisories/GHSA-fmqh-2j2x-vgp3","reference_id":"GHSA-fmqh-2j2x-vgp3","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-fmqh-2j2x-vgp3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23184?format=json","purl":"pkg:composer/drupal/core@8.1.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-d4qd-ut89-gbf4"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hpsp-5qtj-v7dq"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-m1ur-bb9m-m7d5"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-sktb-khbq-cuaq"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-vy1y-zkf3-4ue4"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"},{"vulnerability":"VCID-yrzt-3m97-53ce"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.1.10"}],"aliases":["CVE-2016-7572","GHSA-fmqh-2j2x-vgp3"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zvtp-4we3-qygx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7502?format=json","vulnerability_id":"VCID-zxqc-67jp-uba7","summary":"Saving user accounts can sometimes grant the user all roles\nThe User module in Drupal allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-6211","reference_id":"","reference_type":"","scores":[{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.7825","published_at":"2026-04-02T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78299","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78304","published_at":"2026-04-12T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78321","published_at":"2026-04-11T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78295","published_at":"2026-04-09T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78289","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78263","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78281","published_at":"2026-04-04T12:55:00Z"},{"value":"0.01128","scoring_system":"epss","scoring_elements":"0.78242","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-6211"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6211","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6211"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-6211.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-6211.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-6211.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-6211.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6211","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6211"},{"reference_url":"https://www.drupal.org/SA-CORE-2016-002","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/SA-CORE-2016-002"},{"reference_url":"http://www.debian.org/security/2016/dsa-3604","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.debian.org/security/2016/dsa-3604"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/07/13/4","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2016/07/13/4"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/07/13/7","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2016/07/13/7"},{"reference_url":"http://www.securityfocus.com/bid/91230","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/91230"},{"reference_url":"https://github.com/advisories/GHSA-frqf-9qr4-6vxf","reference_id":"GHSA-frqf-9qr4-6vxf","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-frqf-9qr4-6vxf"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22707?format=json","purl":"pkg:composer/drupal/core@8.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1922-fwnz-wkbt"},{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-3hf4-tvxn-zyh4"},{"vulnerability":"VCID-3sr6-86jw-6fb9"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-4wwt-vt76-dbe1"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5kh7-v1uc-wfha"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-77zc-1gc8-r7b7"},{"vulnerability":"VCID-7fs3-gwc7-nkes"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9ss3-mvt3-8bem"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-bkxp-gn34-67av"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-d4qd-ut89-gbf4"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-dqf8-ea9f-yber"},{"vulnerability":"VCID-ed6y-c9tz-mbds"},{"vulnerability":"VCID-fm5k-u7s6-wfhb"},{"vulnerability":"VCID-fwbj-ctxz-2bc6"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-g33x-1paw-7udm"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-hgb1-xrne-e7c8"},{"vulnerability":"VCID-hpsp-5qtj-v7dq"},{"vulnerability":"VCID-hwnd-nuv7-jqbh"},{"vulnerability":"VCID-hzr8-ttbu-ebhg"},{"vulnerability":"VCID-j21d-w3g7-cbcg"},{"vulnerability":"VCID-jctf-yffu-hbag"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-jrb8-jnz4-83c8"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kam1-84p4-qych"},{"vulnerability":"VCID-kdnk-7mz5-7ugf"},{"vulnerability":"VCID-krhy-kg1b-rfbk"},{"vulnerability":"VCID-m1ur-bb9m-m7d5"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-qvbt-7e55-4bg4"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-sktb-khbq-cuaq"},{"vulnerability":"VCID-st6v-ch5g-r7h2"},{"vulnerability":"VCID-syrg-ckq7-cbd6"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-ummk-h11z-bkaj"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vrdx-165p-efda"},{"vulnerability":"VCID-vy1y-zkf3-4ue4"},{"vulnerability":"VCID-w6cz-mg4v-3udj"},{"vulnerability":"VCID-wabj-ty5p-pfd6"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-wzgs-fr3u-cbdn"},{"vulnerability":"VCID-x2as-f9fx-9kff"},{"vulnerability":"VCID-y74s-ghyc-2bhs"},{"vulnerability":"VCID-yare-57j9-j7cs"},{"vulnerability":"VCID-ymka-jfep-87gt"},{"vulnerability":"VCID-yrzt-3m97-53ce"},{"vulnerability":"VCID-yty5-zn46-r3dj"},{"vulnerability":"VCID-zvtp-4we3-qygx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.1.0"}],"aliases":["CVE-2016-6211","GHSA-frqf-9qr4-6vxf"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zxqc-67jp-uba7"}],"fixing_vulnerabilities":[],"risk_score":"10.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.0.6"}