{"url":"http://public2.vulnerablecode.io/api/packages/80628?format=json","purl":"pkg:composer/drupal/core@8.8.8","type":"composer","namespace":"drupal","name":"core","version":"8.8.8","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"10.1.8","latest_non_vulnerable_version":"11.3.7","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5227?format=json","vulnerability_id":"VCID-2fas-m6vh-myhc","summary":"multiple issues","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13677","reference_id":"","reference_type":"","scores":[{"value":"0.00198","scoring_system":"epss","scoring_elements":"0.41744","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00198","scoring_system":"epss","scoring_elements":"0.4182","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13677"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/7a9bef4b4750d79ab42498e459012cabe4c4bd8b","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/7a9bef4b4750d79ab42498e459012cabe4c4bd8b"},{"reference_url":"https://www.drupal.org/sa-core-2021-010","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2021-010"},{"reference_url":"https://security.archlinux.org/AVG-2407","reference_id":"AVG-2407","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-2407"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13677","reference_id":"CVE-2020-13677","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13677"},{"reference_url":"https://github.com/advisories/GHSA-3xr3-phjp-g6p2","reference_id":"GHSA-3xr3-phjp-g6p2","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3xr3-phjp-g6p2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60653?format=json","purl":"pkg:composer/drupal/core@8.9.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.19"},{"url":"http://public2.vulnerablecode.io/api/packages/60639?format=json","purl":"pkg:composer/drupal/core@9.1.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.13"},{"url":"http://public2.vulnerablecode.io/api/packages/60640?format=json","purl":"pkg:composer/drupal/core@9.2.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2g67-a42m-qfbh"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5nbj-5x5a-93hz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-ydy1-x277-1fhj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.2.6"}],"aliases":["CVE-2020-13677","GHSA-3xr3-phjp-g6p2"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2fas-m6vh-myhc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5228?format=json","vulnerability_id":"VCID-2t34-82p3-73c3","summary":"multiple issues","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13676","reference_id":"","reference_type":"","scores":[{"value":"0.00285","scoring_system":"epss","scoring_elements":"0.52072","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00285","scoring_system":"epss","scoring_elements":"0.52133","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13676"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/8e8e3d2ddd72471ba886346ecabfb5d98fd27d9b","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/8e8e3d2ddd72471ba886346ecabfb5d98fd27d9b"},{"reference_url":"https://www.drupal.org/sa-core-2021-009","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2021-009"},{"reference_url":"https://security.archlinux.org/AVG-2407","reference_id":"AVG-2407","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-2407"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13676","reference_id":"CVE-2020-13676","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13676"},{"reference_url":"https://github.com/advisories/GHSA-qfhg-m6r8-xxpj","reference_id":"GHSA-qfhg-m6r8-xxpj","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qfhg-m6r8-xxpj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60653?format=json","purl":"pkg:composer/drupal/core@8.9.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.19"},{"url":"http://public2.vulnerablecode.io/api/packages/60639?format=json","purl":"pkg:composer/drupal/core@9.1.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.13"},{"url":"http://public2.vulnerablecode.io/api/packages/60640?format=json","purl":"pkg:composer/drupal/core@9.2.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2g67-a42m-qfbh"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5nbj-5x5a-93hz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-ydy1-x277-1fhj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.2.6"}],"aliases":["CVE-2020-13676","GHSA-qfhg-m6r8-xxpj"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2t34-82p3-73c3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/42389?format=json","vulnerability_id":"VCID-31qy-vagp-83b6","summary":"Exposure of Resource to Wrong Sphere\nInformation Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13670","reference_id":"","reference_type":"","scores":[{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62662","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62706","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13670"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/f93a37b713b59f8d24e826bc74378099853eef3d","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/f93a37b713b59f8d24e826bc74378099853eef3d"},{"reference_url":"https://www.drupal.org/sa-core-2020-011","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-011"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13670","reference_id":"CVE-2020-13670","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13670"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13670.yaml","reference_id":"CVE-2020-13670.YAML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13670.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13670.yaml","reference_id":"CVE-2020-13670.YAML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13670.yaml"},{"reference_url":"https://github.com/advisories/GHSA-mmjr-5q74-p3m4","reference_id":"GHSA-mmjr-5q74-p3m4","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mmjr-5q74-p3m4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60658?format=json","purl":"pkg:composer/drupal/core@8.8.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.10"},{"url":"http://public2.vulnerablecode.io/api/packages/60651?format=json","purl":"pkg:composer/drupal/core@8.9.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.6"},{"url":"http://public2.vulnerablecode.io/api/packages/60652?format=json","purl":"pkg:composer/drupal/core@9.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.6"}],"aliases":["CVE-2020-13670","GHSA-mmjr-5q74-p3m4"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-31qy-vagp-83b6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45051?format=json","vulnerability_id":"VCID-3xk4-qwaq-5yaj","summary":"Improper Access Control\nUnder certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25278","reference_id":"","reference_type":"","scores":[{"value":"0.00479","scoring_system":"epss","scoring_elements":"0.6539","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00479","scoring_system":"epss","scoring_elements":"0.65441","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25278"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2022-013","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T18:39:47Z/"}],"url":"https://www.drupal.org/sa-core-2022-013"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25278","reference_id":"CVE-2022-25278","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25278"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25278.yaml","reference_id":"CVE-2022-25278.YAML","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25278.yaml"},{"reference_url":"https://github.com/advisories/GHSA-cfh2-7f6h-3m85","reference_id":"GHSA-cfh2-7f6h-3m85","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-cfh2-7f6h-3m85"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/64975?format=json","purl":"pkg:composer/drupal/core@9.3.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.19"},{"url":"http://public2.vulnerablecode.io/api/packages/64976?format=json","purl":"pkg:composer/drupal/core@9.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.4.3"}],"aliases":["CVE-2022-25278","GHSA-cfh2-7f6h-3m85"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3xk4-qwaq-5yaj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/46109?format=json","vulnerability_id":"VCID-54qh-fz2a-cyh6","summary":"Generation of Error Message Containing Sensitive Information\nIn certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.\n\nThis vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.\n\nThe core REST and contributed GraphQL modules are not affected.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-5256","reference_id":"","reference_type":"","scores":[{"value":"0.01295","scoring_system":"epss","scoring_elements":"0.80058","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-5256"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/1cd2741c2b43f6ad1bdfc121b8d9ec3b87e70742","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/1cd2741c2b43f6ad1bdfc121b8d9ec3b87e70742"},{"reference_url":"https://github.com/drupal/core/commit/5495dc530e3acd056478245bfe1828210c6da7dc","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/5495dc530e3acd056478245bfe1828210c6da7dc"},{"reference_url":"https://github.com/drupal/core/commit/d4fe67562ee3ea0d9ecb9672d2945d94c5633d24","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/d4fe67562ee3ea0d9ecb9672d2945d94c5633d24"},{"reference_url":"https://www.drupal.org/sa-core-2023-006","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-23T18:22:43Z/"}],"url":"https://www.drupal.org/sa-core-2023-006"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5256","reference_id":"CVE-2023-5256","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5256"},{"reference_url":"https://github.com/advisories/GHSA-rjqg-3h9m-fx5x","reference_id":"GHSA-rjqg-3h9m-fx5x","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-rjqg-3h9m-fx5x"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67144?format=json","purl":"pkg:composer/drupal/core@9.5.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.5.11"},{"url":"http://public2.vulnerablecode.io/api/packages/67145?format=json","purl":"pkg:composer/drupal/core@10.0.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.0.11"},{"url":"http://public2.vulnerablecode.io/api/packages/67146?format=json","purl":"pkg:composer/drupal/core@10.1.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.1.4"}],"aliases":["CVE-2023-5256","GHSA-rjqg-3h9m-fx5x"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-54qh-fz2a-cyh6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/53806?format=json","vulnerability_id":"VCID-5jy9-mhbb-nuh7","summary":"Deserialization of Untrusted Data\nArchive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-28948.json","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-28948.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-28948","reference_id":"","reference_type":"","scores":[{"value":"0.76873","scoring_system":"epss","scoring_elements":"0.98976","published_at":"2026-06-05T12:55:00Z"},{"value":"0.76873","scoring_system":"epss","scoring_elements":"0.98975","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-28948"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28948","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28948"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28949","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28949"},{"reference_url":"https://github.com/pear/Archive_Tar","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pear/Archive_Tar"},{"reference_url":"https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da"},{"reference_url":"https://github.com/pear/Archive_Tar/issues/33","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pear/Archive_Tar/issues/33"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N"},{"reference_url":"https://security.gentoo.org/glsa/202101-23","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202101-23"},{"reference_url":"https://www.debian.org/security/2020/dsa-4817","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2020/dsa-4817"},{"reference_url":"https://www.drupal.org/sa-core-2020-013","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-013"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1904001","reference_id":"1904001","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1904001"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976108","reference_id":"976108","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976108"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28948","reference_id":"CVE-2020-28948","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28948"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6541","reference_id":"RHSA-2022:6541","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6541"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6542","reference_id":"RHSA-2022:6542","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6542"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:7340","reference_id":"RHSA-2022:7340","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:7340"},{"reference_url":"https://usn.ubuntu.com/4654-1/","reference_id":"USN-4654-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4654-1/"},{"reference_url":"https://usn.ubuntu.com/6981-1/","reference_id":"USN-6981-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6981-1/"},{"reference_url":"https://usn.ubuntu.com/6981-2/","reference_id":"USN-6981-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6981-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/79181?format=json","purl":"pkg:composer/drupal/core@8.9.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.10"},{"url":"http://public2.vulnerablecode.io/api/packages/249831?format=json","purl":"pkg:composer/drupal/core@9.0.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.0-alpha1"},{"url":"http://public2.vulnerablecode.io/api/packages/79182?format=json","purl":"pkg:composer/drupal/core@9.0.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.9"},{"url":"http://public2.vulnerablecode.io/api/packages/280810?format=json","purl":"pkg:composer/drupal/core@9.1.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.0-alpha1"}],"aliases":["CVE-2020-28948","GHSA-jh5x-hfhg-78jq"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5jy9-mhbb-nuh7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5230?format=json","vulnerability_id":"VCID-7v89-2sss-hfaz","summary":"multiple issues","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13674","reference_id":"","reference_type":"","scores":[{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.3383","published_at":"2026-06-04T12:55:00Z"},{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.33934","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13674"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/20cd85db8198c63101bd050ea973b13f2f3edef6","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/20cd85db8198c63101bd050ea973b13f2f3edef6"},{"reference_url":"https://github.com/drupal/core/commit/6359b3ea5aacf85399285c522c6d787a218c897c","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/6359b3ea5aacf85399285c522c6d787a218c897c"},{"reference_url":"https://github.com/drupal/core/commit/801910fcdfc14ee6120051089a2129e455186ad8","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/801910fcdfc14ee6120051089a2129e455186ad8"},{"reference_url":"https://www.drupal.org/sa-core-2021-007","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2021-007"},{"reference_url":"https://security.archlinux.org/AVG-2407","reference_id":"AVG-2407","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-2407"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13674","reference_id":"CVE-2020-13674","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13674"},{"reference_url":"https://github.com/advisories/GHSA-j586-cj67-vg4p","reference_id":"GHSA-j586-cj67-vg4p","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-j586-cj67-vg4p"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60653?format=json","purl":"pkg:composer/drupal/core@8.9.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.19"},{"url":"http://public2.vulnerablecode.io/api/packages/60639?format=json","purl":"pkg:composer/drupal/core@9.1.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.13"},{"url":"http://public2.vulnerablecode.io/api/packages/60640?format=json","purl":"pkg:composer/drupal/core@9.2.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2g67-a42m-qfbh"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5nbj-5x5a-93hz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-ydy1-x277-1fhj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.2.6"}],"aliases":["CVE-2020-13674","GHSA-j586-cj67-vg4p"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-7v89-2sss-hfaz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/53808?format=json","vulnerability_id":"VCID-9dfs-rpqy-6kfa","summary":"Injection Vulnerability\narchive_tar has `://` filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as `file://` to overwrite files) can still succeed.","references":[{"reference_url":"http://packetstormsecurity.com/files/161095/PEAR-Archive_Tar-Arbitrary-File-Write.html","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:49:30Z/"}],"url":"http://packetstormsecurity.com/files/161095/PEAR-Archive_Tar-Arbitrary-File-Write.html"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-28949.json","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-28949.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-28949","reference_id":"","reference_type":"","scores":[{"value":"0.93364","scoring_system":"epss","scoring_elements":"0.99822","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-28949"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28948","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28948"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28949","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28949"},{"reference_url":"https://github.com/pear/Archive_Tar","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pear/Archive_Tar"},{"reference_url":"https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da"},{"reference_url":"https://github.com/pear/Archive_Tar/issues/33","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:49:30Z/"}],"url":"https://github.com/pear/Archive_Tar/issues/33"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:49:30Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N"},{"reference_url":"https://security.gentoo.org/glsa/202101-23","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:49:30Z/"}],"url":"https://security.gentoo.org/glsa/202101-23"},{"reference_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-28949","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-28949"},{"reference_url":"https://www.debian.org/security/2020/dsa-4817","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:49:30Z/"}],"url":"https://www.debian.org/security/2020/dsa-4817"},{"reference_url":"https://www.drupal.org/sa-core-2020-013","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:49:30Z/"}],"url":"https://www.drupal.org/sa-core-2020-013"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1910323","reference_id":"1910323","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1910323"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/","reference_id":"42GPGVVFTLJYAKRI75IVB5R45NYQGEUR","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:49:30Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/","reference_id":"4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:49:30Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/","reference_id":"5KSFM672XW3X6BR7TVKRD63SLZGKK437","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:49:30Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976108","reference_id":"976108","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976108"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28949","reference_id":"CVE-2020-28949","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28949"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/pear/archive_tar/CVE-2020-28949.yaml","reference_id":"CVE-2020-28949.YAML","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/pear/archive_tar/CVE-2020-28949.yaml"},{"reference_url":"https://github.com/advisories/GHSA-75c5-f4gw-38r9","reference_id":"GHSA-75c5-f4gw-38r9","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-75c5-f4gw-38r9"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/","reference_id":"KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:49:30Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP/","reference_id":"NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:49:30Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP/"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6541","reference_id":"RHSA-2022:6541","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6541"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:6542","reference_id":"RHSA-2022:6542","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:6542"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:7340","reference_id":"RHSA-2022:7340","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:7340"},{"reference_url":"https://usn.ubuntu.com/4654-1/","reference_id":"USN-4654-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4654-1/"},{"reference_url":"https://usn.ubuntu.com/6981-1/","reference_id":"USN-6981-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6981-1/"},{"reference_url":"https://usn.ubuntu.com/6981-2/","reference_id":"USN-6981-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6981-2/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/","reference_id":"VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:49:30Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/79189?format=json","purl":"pkg:composer/drupal/core@8.8.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.12"},{"url":"http://public2.vulnerablecode.io/api/packages/253814?format=json","purl":"pkg:composer/drupal/core@8.9.0-beta1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.0-beta1"},{"url":"http://public2.vulnerablecode.io/api/packages/79181?format=json","purl":"pkg:composer/drupal/core@8.9.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.10"},{"url":"http://public2.vulnerablecode.io/api/packages/249831?format=json","purl":"pkg:composer/drupal/core@9.0.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.0-alpha1"},{"url":"http://public2.vulnerablecode.io/api/packages/79182?format=json","purl":"pkg:composer/drupal/core@9.0.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.9"},{"url":"http://public2.vulnerablecode.io/api/packages/280810?format=json","purl":"pkg:composer/drupal/core@9.1.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.0-alpha1"}],"aliases":["CVE-2020-28949","GHSA-75c5-f4gw-38r9"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9dfs-rpqy-6kfa"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/54493?format=json","vulnerability_id":"VCID-9rmk-e8zd-9bcw","summary":"Incorrect Default Permissions\nAccess bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module does not sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13667","reference_id":"","reference_type":"","scores":[{"value":"0.00144","scoring_system":"epss","scoring_elements":"0.34495","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00144","scoring_system":"epss","scoring_elements":"0.34397","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13667"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13667.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13667.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13667.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13667.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2020-008","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-008"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13667","reference_id":"CVE-2020-13667","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13667"},{"reference_url":"https://github.com/advisories/GHSA-x2q9-r8gm-f657","reference_id":"GHSA-x2q9-r8gm-f657","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-x2q9-r8gm-f657"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60658?format=json","purl":"pkg:composer/drupal/core@8.8.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.10"},{"url":"http://public2.vulnerablecode.io/api/packages/60651?format=json","purl":"pkg:composer/drupal/core@8.9.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.6"},{"url":"http://public2.vulnerablecode.io/api/packages/60652?format=json","purl":"pkg:composer/drupal/core@9.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.6"}],"aliases":["CVE-2020-13667","GHSA-x2q9-r8gm-f657"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9rmk-e8zd-9bcw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45048?format=json","vulnerability_id":"VCID-a7ss-tkb6-gkge","summary":"Improper access control\nIn some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the \"private\" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing files or image styles after updating.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25275","reference_id":"","reference_type":"","scores":[{"value":"0.00579","scoring_system":"epss","scoring_elements":"0.69245","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00579","scoring_system":"epss","scoring_elements":"0.69285","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25275"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/2d5f47fc8a166115f56c2330a81e83abe22445cf","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/2d5f47fc8a166115f56c2330a81e83abe22445cf"},{"reference_url":"https://github.com/drupal/core/commit/e2fbf63700819cb470a1be425798f1a3f2020116","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/e2fbf63700819cb470a1be425798f1a3f2020116"},{"reference_url":"https://www.drupal.org/sa-core-2022-012","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-03T18:45:46Z/"}],"url":"https://www.drupal.org/sa-core-2022-012"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25275","reference_id":"CVE-2022-25275","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25275"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25275.yaml","reference_id":"CVE-2022-25275.YAML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25275.yaml"},{"reference_url":"https://github.com/advisories/GHSA-xh3v-6f9j-wxw3","reference_id":"GHSA-xh3v-6f9j-wxw3","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xh3v-6f9j-wxw3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/64975?format=json","purl":"pkg:composer/drupal/core@9.3.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.19"},{"url":"http://public2.vulnerablecode.io/api/packages/64976?format=json","purl":"pkg:composer/drupal/core@9.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.4.3"}],"aliases":["CVE-2022-25275","GHSA-xh3v-6f9j-wxw3","GMS-2022-3362"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-a7ss-tkb6-gkge"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/42761?format=json","vulnerability_id":"VCID-ard5-3cjv-1beu","summary":"Improper Input Validation\nguzzlehttp/psr7 is a PSR-7 HTTP message library used in drupal. Versions prior to 1.8.4 and 2.1.1 is vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24775","reference_id":"","reference_type":"","scores":[{"value":"0.00931","scoring_system":"epss","scoring_elements":"0.76518","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00931","scoring_system":"epss","scoring_elements":"0.76489","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24775"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24775","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24775"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2022-24775.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2022-24775.yaml"},{"reference_url":"https://github.com/guzzle/psr7","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/guzzle/psr7"},{"reference_url":"https://github.com/guzzle/psr7/pull/485/commits/e55afaa3fc138c89adf3b55a8ba20dc60d17f1f1","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:56:31Z/"}],"url":"https://github.com/guzzle/psr7/pull/485/commits/e55afaa3fc138c89adf3b55a8ba20dc60d17f1f1"},{"reference_url":"https://github.com/guzzle/psr7/pull/486/commits/9a96d9db668b485361ed9de7b5bf1e54895df1dc","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:56:31Z/"}],"url":"https://github.com/guzzle/psr7/pull/486/commits/9a96d9db668b485361ed9de7b5bf1e54895df1dc"},{"reference_url":"https://www.drupal.org/sa-core-2022-006","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:56:31Z/"}],"url":"https://www.drupal.org/sa-core-2022-006"},{"reference_url":"https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008236","reference_id":"1008236","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008236"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24775","reference_id":"CVE-2022-24775","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24775"},{"reference_url":"https://github.com/advisories/GHSA-q7rv-6hp3-vh96","reference_id":"GHSA-q7rv-6hp3-vh96","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-q7rv-6hp3-vh96"},{"reference_url":"https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96","reference_id":"GHSA-q7rv-6hp3-vh96","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:56:31Z/"}],"url":"https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96"},{"reference_url":"https://usn.ubuntu.com/6670-1/","reference_id":"USN-6670-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6670-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61057?format=json","purl":"pkg:composer/drupal/core@9.2.16","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5nbj-5x5a-93hz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.2.16"},{"url":"http://public2.vulnerablecode.io/api/packages/563477?format=json","purl":"pkg:composer/drupal/core@9.3.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.0-alpha1"},{"url":"http://public2.vulnerablecode.io/api/packages/61058?format=json","purl":"pkg:composer/drupal/core@9.3.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5nbj-5x5a-93hz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-g1ew-tnk9-cuh7"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.9"},{"url":"http://public2.vulnerablecode.io/api/packages/563480?format=json","purl":"pkg:composer/drupal/core@10.0.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.0.0-alpha1"}],"aliases":["CVE-2022-24775","GHSA-q7rv-6hp3-vh96"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ard5-3cjv-1beu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/42386?format=json","vulnerability_id":"VCID-avmn-kqky-83dd","summary":"Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor\nCross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13669","reference_id":"","reference_type":"","scores":[{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42349","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42424","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13669"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2020-010","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-010"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13669","reference_id":"CVE-2020-13669","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13669"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13669.yaml","reference_id":"CVE-2020-13669.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13669.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13669.yaml","reference_id":"CVE-2020-13669.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13669.yaml"},{"reference_url":"https://github.com/advisories/GHSA-c533-c843-67h8","reference_id":"GHSA-c533-c843-67h8","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-c533-c843-67h8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60658?format=json","purl":"pkg:composer/drupal/core@8.8.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.10"},{"url":"http://public2.vulnerablecode.io/api/packages/60651?format=json","purl":"pkg:composer/drupal/core@8.9.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.6"},{"url":"http://public2.vulnerablecode.io/api/packages/60652?format=json","purl":"pkg:composer/drupal/core@9.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.6"}],"aliases":["CVE-2020-13669","GHSA-c533-c843-67h8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-avmn-kqky-83dd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5229?format=json","vulnerability_id":"VCID-dav9-pgdh-8yey","summary":"multiple issues","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13675","reference_id":"","reference_type":"","scores":[{"value":"0.00797","scoring_system":"epss","scoring_elements":"0.74383","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00797","scoring_system":"epss","scoring_elements":"0.7435","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13675"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2021-008","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2021-008"},{"reference_url":"https://security.archlinux.org/AVG-2407","reference_id":"AVG-2407","reference_type":"","scores":[{"value":"High","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-2407"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13675","reference_id":"CVE-2020-13675","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13675"},{"reference_url":"https://github.com/advisories/GHSA-v8wr-r69p-mmwx","reference_id":"GHSA-v8wr-r69p-mmwx","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v8wr-r69p-mmwx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60653?format=json","purl":"pkg:composer/drupal/core@8.9.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.19"},{"url":"http://public2.vulnerablecode.io/api/packages/60639?format=json","purl":"pkg:composer/drupal/core@9.1.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.13"},{"url":"http://public2.vulnerablecode.io/api/packages/60640?format=json","purl":"pkg:composer/drupal/core@9.2.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2g67-a42m-qfbh"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5nbj-5x5a-93hz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-ydy1-x277-1fhj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.2.6"}],"aliases":["CVE-2020-13675","GHSA-v8wr-r69p-mmwx"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dav9-pgdh-8yey"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45050?format=json","vulnerability_id":"VCID-dyhz-g3nv-yuc3","summary":"Lack of domain validation in Druple core\nThe Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25276","reference_id":"","reference_type":"","scores":[{"value":"0.01831","scoring_system":"epss","scoring_elements":"0.83257","published_at":"2026-06-04T12:55:00Z"},{"value":"0.01831","scoring_system":"epss","scoring_elements":"0.83283","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25276"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2022-015","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2022-015"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25276","reference_id":"CVE-2022-25276","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25276"},{"reference_url":"https://github.com/advisories/GHSA-4wfq-jc9h-vpcx","reference_id":"GHSA-4wfq-jc9h-vpcx","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-4wfq-jc9h-vpcx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/64975?format=json","purl":"pkg:composer/drupal/core@9.3.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.19"},{"url":"http://public2.vulnerablecode.io/api/packages/64976?format=json","purl":"pkg:composer/drupal/core@9.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.4.3"}],"aliases":["CVE-2022-25276","GHSA-4wfq-jc9h-vpcx"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dyhz-g3nv-yuc3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45057?format=json","vulnerability_id":"VCID-egtv-y9w1-skgr","summary":"Improper Input Validation\nDrupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25273","reference_id":"","reference_type":"","scores":[{"value":"0.0047","scoring_system":"epss","scoring_elements":"0.64955","published_at":"2026-06-05T12:55:00Z"},{"value":"0.0047","scoring_system":"epss","scoring_elements":"0.64912","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25273"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2022-008","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-03T19:19:11Z/"}],"url":"https://www.drupal.org/sa-core-2022-008"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25273","reference_id":"CVE-2022-25273","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25273"},{"reference_url":"https://github.com/advisories/GHSA-g36h-4jr6-qmm9","reference_id":"GHSA-g36h-4jr6-qmm9","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-g36h-4jr6-qmm9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/64994?format=json","purl":"pkg:composer/drupal/core@9.2.18","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5nbj-5x5a-93hz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.2.18"},{"url":"http://public2.vulnerablecode.io/api/packages/64995?format=json","purl":"pkg:composer/drupal/core@9.3.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5nbj-5x5a-93hz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.12"}],"aliases":["CVE-2022-25273","GHSA-g36h-4jr6-qmm9"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-egtv-y9w1-skgr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/97953?format=json","vulnerability_id":"VCID-hkch-a5yn-jyg1","summary":"Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-39261","reference_id":"","reference_type":"","scores":[{"value":"0.09505","scoring_system":"epss","scoring_elements":"0.92989","published_at":"2026-06-04T12:55:00Z"},{"value":"0.09505","scoring_system":"epss","scoring_elements":"0.93","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-39261"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39261","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39261"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2022-39261.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2022-39261.yaml"},{"reference_url":"https://github.com/twigphp/Twig","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/twigphp/Twig"},{"reference_url":"https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b"},{"reference_url":"https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00016.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00016.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39261","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39261"},{"reference_url":"https://symfony.com/blog/twig-security-release-possibility-to-load-a-template-outside-a-configured-directory-when-using-the-filesystem-loader","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://symfony.com/blog/twig-security-release-possibility-to-load-a-template-outside-a-configured-directory-when-using-the-filesystem-loader"},{"reference_url":"https://www.debian.org/security/2022/dsa-5248","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://www.debian.org/security/2022/dsa-5248"},{"reference_url":"https://www.drupal.org/sa-core-2022-016","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://www.drupal.org/sa-core-2022-016"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1020991","reference_id":"1020991","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1020991"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/","reference_id":"2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/","reference_id":"AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/"},{"reference_url":"https://github.com/advisories/GHSA-52m2-vc4m-jj33","reference_id":"GHSA-52m2-vc4m-jj33","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-52m2-vc4m-jj33"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/","reference_id":"NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/","reference_id":"TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/"},{"reference_url":"https://usn.ubuntu.com/5947-1/","reference_id":"USN-5947-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5947-1/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/","reference_id":"WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/","reference_id":"YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:50:56Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/504477?format=json","purl":"pkg:composer/drupal/core@9.3.22","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.22"},{"url":"http://public2.vulnerablecode.io/api/packages/587748?format=json","purl":"pkg:composer/drupal/core@9.4.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.4.0-alpha1"},{"url":"http://public2.vulnerablecode.io/api/packages/504478?format=json","purl":"pkg:composer/drupal/core@9.4.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.4.7"},{"url":"http://public2.vulnerablecode.io/api/packages/612181?format=json","purl":"pkg:composer/drupal/core@9.5.0-beta1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.5.0-beta1"}],"aliases":["CVE-2022-39261","GHSA-52m2-vc4m-jj33"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hkch-a5yn-jyg1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/42392?format=json","vulnerability_id":"VCID-nacy-y1qt-5yhb","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nAccess Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13668","reference_id":"","reference_type":"","scores":[{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44935","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.45004","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13668"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/3184fa4b2f3b65b44884b5e858cdc7794d34b4c8","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/3184fa4b2f3b65b44884b5e858cdc7794d34b4c8"},{"reference_url":"https://github.com/drupal/core/commit/58330ba58d1ac6f1a0a549e8dbde8a3e094bf4fb","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/58330ba58d1ac6f1a0a549e8dbde8a3e094bf4fb"},{"reference_url":"https://github.com/drupal/core/commit/d4be028d81fb6b067513d788b60c3e6fc8fbd0a2","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/d4be028d81fb6b067513d788b60c3e6fc8fbd0a2"},{"reference_url":"https://www.drupal.org/sa-core-2020-009","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-009"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13668","reference_id":"CVE-2020-13668","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13668"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13668.yaml","reference_id":"CVE-2020-13668.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13668.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13668.yaml","reference_id":"CVE-2020-13668.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13668.yaml"},{"reference_url":"https://github.com/advisories/GHSA-m6q5-wv4x-fv6h","reference_id":"GHSA-m6q5-wv4x-fv6h","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-m6q5-wv4x-fv6h"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60658?format=json","purl":"pkg:composer/drupal/core@8.8.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.10"},{"url":"http://public2.vulnerablecode.io/api/packages/60651?format=json","purl":"pkg:composer/drupal/core@8.9.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.6"},{"url":"http://public2.vulnerablecode.io/api/packages/60652?format=json","purl":"pkg:composer/drupal/core@9.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.6"}],"aliases":["CVE-2020-13668","GHSA-m6q5-wv4x-fv6h"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nacy-y1qt-5yhb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/54839?format=json","vulnerability_id":"VCID-pzp5-2bpz-jfe2","summary":"Drupal core Cross-Site Scripting (XSS) vulnerabilities\nThe Drupal project uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.\n\nVulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2021-05-26.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2021-05-26.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2021-005","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2021-005"},{"reference_url":"https://github.com/advisories/GHSA-vfgc-c76h-mwh4","reference_id":"GHSA-vfgc-c76h-mwh4","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vfgc-c76h-mwh4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/81381?format=json","purl":"pkg:composer/drupal/core@8.9.18","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.18"},{"url":"http://public2.vulnerablecode.io/api/packages/81382?format=json","purl":"pkg:composer/drupal/core@9.1.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.12"},{"url":"http://public2.vulnerablecode.io/api/packages/81383?format=json","purl":"pkg:composer/drupal/core@9.2.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2g67-a42m-qfbh"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5nbj-5x5a-93hz"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-ydy1-x277-1fhj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.2.4"}],"aliases":["GHSA-vfgc-c76h-mwh4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-pzp5-2bpz-jfe2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45056?format=json","vulnerability_id":"VCID-rd4g-h1j9-23cb","summary":"Unrestricted Upload of File with Dangerous Type\nDrupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously does not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25277","reference_id":"","reference_type":"","scores":[{"value":"0.02448","scoring_system":"epss","scoring_elements":"0.85496","published_at":"2026-06-05T12:55:00Z"},{"value":"0.02448","scoring_system":"epss","scoring_elements":"0.85472","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25277"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/1cd1830d79f221cc8490f53c2bb487dd07094f17","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/1cd1830d79f221cc8490f53c2bb487dd07094f17"},{"reference_url":"https://github.com/drupal/core/commit/5d464ea4407c50e40dcf6cb5ee376e7b8dd36f3a","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/5d464ea4407c50e40dcf6cb5ee376e7b8dd36f3a"},{"reference_url":"https://www.drupal.org/sa-core-2022-014","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-03T18:41:13Z/"}],"url":"https://www.drupal.org/sa-core-2022-014"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25277","reference_id":"CVE-2022-25277","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25277"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25277.yaml","reference_id":"CVE-2022-25277.YAML","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25277.yaml"},{"reference_url":"https://github.com/advisories/GHSA-6955-67hm-vjjq","reference_id":"GHSA-6955-67hm-vjjq","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6955-67hm-vjjq"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/64975?format=json","purl":"pkg:composer/drupal/core@9.3.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.3.19"},{"url":"http://public2.vulnerablecode.io/api/packages/64976?format=json","purl":"pkg:composer/drupal/core@9.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.4.3"}],"aliases":["CVE-2022-25277","GHSA-6955-67hm-vjjq","GMS-2022-3361"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rd4g-h1j9-23cb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/54438?format=json","vulnerability_id":"VCID-sg4r-hncm-dqcq","summary":"Cross-site Scripting\nA cross-site scripting vulnerability exists in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13666","reference_id":"","reference_type":"","scores":[{"value":"0.00509","scoring_system":"epss","scoring_elements":"0.66703","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00509","scoring_system":"epss","scoring_elements":"0.66744","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13666"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13666.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13666.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13666.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13666.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2020-007","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-007"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13666","reference_id":"CVE-2020-13666","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13666"},{"reference_url":"https://github.com/advisories/GHSA-8jj2-x2gc-ggm7","reference_id":"GHSA-8jj2-x2gc-ggm7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8jj2-x2gc-ggm7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60658?format=json","purl":"pkg:composer/drupal/core@8.8.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.10"},{"url":"http://public2.vulnerablecode.io/api/packages/60651?format=json","purl":"pkg:composer/drupal/core@8.9.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.6"},{"url":"http://public2.vulnerablecode.io/api/packages/60652?format=json","purl":"pkg:composer/drupal/core@9.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.6"}],"aliases":["CVE-2020-13666","GHSA-8jj2-x2gc-ggm7"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sg4r-hncm-dqcq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47000?format=json","vulnerability_id":"VCID-t89y-c9hq-9bhk","summary":"Drupal core Denial of Service vulnerability\nThe Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).\n\nSites that do not use the Comment module are not affected.","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/2f76ac716ca8019bc60579fdfc8aa6cd65d57dff","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/2f76ac716ca8019bc60579fdfc8aa6cd65d57dff"},{"reference_url":"https://github.com/drupal/core/commit/5e606b560ac4ecb08135f12b6165bbe0348346a0","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/5e606b560ac4ecb08135f12b6165bbe0348346a0"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2024-01-17.yaml","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2024-01-17.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2024-001","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2024-001"},{"reference_url":"https://github.com/advisories/GHSA-6ccv-8fgf-cjpw","reference_id":"GHSA-6ccv-8fgf-cjpw","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6ccv-8fgf-cjpw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/68876?format=json","purl":"pkg:composer/drupal/core@10.1.8","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.1.8"},{"url":"http://public2.vulnerablecode.io/api/packages/68877?format=json","purl":"pkg:composer/drupal/core@10.2.2","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@10.2.2"}],"aliases":["GHSA-6ccv-8fgf-cjpw","GMS-2024-214"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-t89y-c9hq-9bhk"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/3853?format=json","vulnerability_id":"VCID-tpzm-u3qp-akc8","summary":"multiple issues","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13672","reference_id":"","reference_type":"","scores":[{"value":"0.00555","scoring_system":"epss","scoring_elements":"0.6851","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00555","scoring_system":"epss","scoring_elements":"0.68469","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13672"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2021-002","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2021-002"},{"reference_url":"https://security.archlinux.org/AVG-1463","reference_id":"AVG-1463","reference_type":"","scores":[{"value":"Critical","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1463"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13672","reference_id":"CVE-2020-13672","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13672"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13672.yaml","reference_id":"CVE-2020-13672.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13672.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13672.yaml","reference_id":"CVE-2020-13672.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13672.yaml"},{"reference_url":"https://github.com/advisories/GHSA-3m36-mjwj-352c","reference_id":"GHSA-3m36-mjwj-352c","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3m36-mjwj-352c"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60655?format=json","purl":"pkg:composer/drupal/core@8.9.14","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.14"},{"url":"http://public2.vulnerablecode.io/api/packages/60656?format=json","purl":"pkg:composer/drupal/core@9.0.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.12"},{"url":"http://public2.vulnerablecode.io/api/packages/60657?format=json","purl":"pkg:composer/drupal/core@9.1.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.1.7"}],"aliases":["CVE-2020-13672","GHSA-3m36-mjwj-352c"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-tpzm-u3qp-akc8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/54884?format=json","vulnerability_id":"VCID-uq9s-79g7-rqh6","summary":"Drupal core Arbitrary PHP code execution\nThe Drupal project uses the PEAR Archive_Tar library. The PEAR Archive_Tar library has released a security update that impacts Drupal. For more information please see:\nCVE-2020-28948\nCVE-2020-28949\n\nMultiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them.\n\nTo mitigate this issue, prevent untrusted users from uploading .tar, .tar.gz, .bz2, or .tlz files.","references":[{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2020-11-25.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2020-11-25.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2020-013","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-013"},{"reference_url":"https://github.com/advisories/GHSA-gxxj-g9v8-w28p","reference_id":"GHSA-gxxj-g9v8-w28p","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gxxj-g9v8-w28p"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/79189?format=json","purl":"pkg:composer/drupal/core@8.8.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.12"},{"url":"http://public2.vulnerablecode.io/api/packages/79181?format=json","purl":"pkg:composer/drupal/core@8.9.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.10"},{"url":"http://public2.vulnerablecode.io/api/packages/79182?format=json","purl":"pkg:composer/drupal/core@9.0.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.9"}],"aliases":["GHSA-gxxj-g9v8-w28p"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-uq9s-79g7-rqh6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41563?format=json","vulnerability_id":"VCID-wsv7-je8g-sqet","summary":"Drupal core Unrestricted Upload of File with Dangerous Type\nDrupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13671","reference_id":"","reference_type":"","scores":[{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89338","published_at":"2026-06-05T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.8932","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13671"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT"},{"reference_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13671","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13671"},{"reference_url":"https://www.drupal.org/sa-core-2020-012","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:31Z/"}],"url":"https://www.drupal.org/sa-core-2020-012"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/","reference_id":"5KSFM672XW3X6BR7TVKRD63SLZGKK437","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:31Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13671","reference_id":"CVE-2020-13671","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13671"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13671.yaml","reference_id":"CVE-2020-13671.YAML","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13671.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13671.yaml","reference_id":"CVE-2020-13671.YAML","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13671.yaml"},{"reference_url":"https://github.com/advisories/GHSA-68jc-v27h-vhmw","reference_id":"GHSA-68jc-v27h-vhmw","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-68jc-v27h-vhmw"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/","reference_id":"KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:31Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/"},{"reference_url":"https://usn.ubuntu.com/6981-1/","reference_id":"USN-6981-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6981-1/"},{"reference_url":"https://usn.ubuntu.com/6981-2/","reference_id":"USN-6981-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6981-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59269?format=json","purl":"pkg:composer/drupal/core@8.8.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.11"},{"url":"http://public2.vulnerablecode.io/api/packages/59268?format=json","purl":"pkg:composer/drupal/core@8.9.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.9"},{"url":"http://public2.vulnerablecode.io/api/packages/59267?format=json","purl":"pkg:composer/drupal/core@9.0.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.8"}],"aliases":["CVE-2020-13671","GHSA-68jc-v27h-vhmw"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wsv7-je8g-sqet"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/54623?format=json","vulnerability_id":"VCID-zr84-4jzv-2fd3","summary":"Cross-site Scripting\nCross-site scripting vulnerability in Drupal Core allows an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13688","reference_id":"","reference_type":"","scores":[{"value":"0.0034","scoring_system":"epss","scoring_elements":"0.56974","published_at":"2026-06-04T12:55:00Z"},{"value":"0.0034","scoring_system":"epss","scoring_elements":"0.57026","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13688"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2020-009","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-009"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13688","reference_id":"CVE-2020-13688","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13688"},{"reference_url":"https://github.com/advisories/GHSA-qf2g-mrrx-rr5p","reference_id":"GHSA-qf2g-mrrx-rr5p","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qf2g-mrrx-rr5p"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60658?format=json","purl":"pkg:composer/drupal/core@8.8.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.10"},{"url":"http://public2.vulnerablecode.io/api/packages/60651?format=json","purl":"pkg:composer/drupal/core@8.9.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.6"},{"url":"http://public2.vulnerablecode.io/api/packages/60652?format=json","purl":"pkg:composer/drupal/core@9.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.6"}],"aliases":["CVE-2020-13688","GHSA-qf2g-mrrx-rr5p"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zr84-4jzv-2fd3"}],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/54440?format=json","vulnerability_id":"VCID-phwu-rdm2-ufhr","summary":"Command Injection\nArbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13664","reference_id":"","reference_type":"","scores":[{"value":"0.01962","scoring_system":"epss","scoring_elements":"0.83862","published_at":"2026-06-05T12:55:00Z"},{"value":"0.01962","scoring_system":"epss","scoring_elements":"0.83838","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13664"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13664.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13664.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13664.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13664.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2020-005","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-005"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13664","reference_id":"CVE-2020-13664","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13664"},{"reference_url":"https://github.com/advisories/GHSA-x72f-ggjw-v5xh","reference_id":"GHSA-x72f-ggjw-v5xh","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-x72f-ggjw-v5xh"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/80628?format=json","purl":"pkg:composer/drupal/core@8.8.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-31qy-vagp-83b6"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-9rmk-e8zd-9bcw"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-avmn-kqky-83dd"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-nacy-y1qt-5yhb"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-sg4r-hncm-dqcq"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"},{"vulnerability":"VCID-zr84-4jzv-2fd3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.8"},{"url":"http://public2.vulnerablecode.io/api/packages/80629?format=json","purl":"pkg:composer/drupal/core@8.9.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-31qy-vagp-83b6"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-9rmk-e8zd-9bcw"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-avmn-kqky-83dd"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-nacy-y1qt-5yhb"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-sg4r-hncm-dqcq"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"},{"vulnerability":"VCID-zr84-4jzv-2fd3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.1"},{"url":"http://public2.vulnerablecode.io/api/packages/80630?format=json","purl":"pkg:composer/drupal/core@9.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-31qy-vagp-83b6"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-9rmk-e8zd-9bcw"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-avmn-kqky-83dd"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-nacy-y1qt-5yhb"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-sg4r-hncm-dqcq"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"},{"vulnerability":"VCID-zr84-4jzv-2fd3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.1"}],"aliases":["CVE-2020-13664","GHSA-x72f-ggjw-v5xh"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-phwu-rdm2-ufhr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/54622?format=json","vulnerability_id":"VCID-vz31-7246-aken","summary":"Cross-Site Request Forgery (CSRF)\nCross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13663","reference_id":"","reference_type":"","scores":[{"value":"0.00155","scoring_system":"epss","scoring_elements":"0.35954","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00155","scoring_system":"epss","scoring_elements":"0.36049","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13663"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13663","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13663"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/5f3c4d80fd77df0cfa87722b446db54040d55693","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/5f3c4d80fd77df0cfa87722b446db54040d55693"},{"reference_url":"https://github.com/drupal/core/commit/bc3235dcb5570bbda62ef9547e7604ee060b72c6","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/bc3235dcb5570bbda62ef9547e7604ee060b72c6"},{"reference_url":"https://github.com/drupal/core/commit/faf3243c4ce03bbaab386af2b272b363fd0dfddb","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/faf3243c4ce03bbaab386af2b272b363fd0dfddb"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13663.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13663.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13663.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13663.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2020-004","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-004"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13663","reference_id":"CVE-2020-13663","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13663"},{"reference_url":"https://github.com/advisories/GHSA-m648-hpf8-qcjw","reference_id":"GHSA-m648-hpf8-qcjw","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-m648-hpf8-qcjw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/152935?format=json","purl":"pkg:composer/drupal/core@7.72.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@7.72.0"},{"url":"http://public2.vulnerablecode.io/api/packages/52630?format=json","purl":"pkg:composer/drupal/core@8.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2989-fmjz-nkby"},{"vulnerability":"VCID-2c5f-q858-huaw"},{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2g67-a42m-qfbh"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-31qy-vagp-83b6"},{"vulnerability":"VCID-3pj1-y73r-vyhh"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-4dpp-gg2v-q3et"},{"vulnerability":"VCID-4p4c-7rdc-37fa"},{"vulnerability":"VCID-4pg6-hqge-wkcb"},{"vulnerability":"VCID-4q59-j6u4-qfhk"},{"vulnerability":"VCID-56ze-2yw2-bfh8"},{"vulnerability":"VCID-5c5c-m7ba-kqct"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67w7-gq9f-ukf1"},{"vulnerability":"VCID-6c6t-kmb3-2qcm"},{"vulnerability":"VCID-6s93-1cpz-yyg8"},{"vulnerability":"VCID-7bq1-m8df-k3ba"},{"vulnerability":"VCID-7ear-x9pf-yubc"},{"vulnerability":"VCID-7n7v-41m4-97gk"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-8qd6-8ckc-h3g5"},{"vulnerability":"VCID-9nk8-dban-g7h9"},{"vulnerability":"VCID-a3s2-c4k2-4ufn"},{"vulnerability":"VCID-a4u4-ga84-wyf9"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ah3h-t9qa-gudr"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-asm8-guag-b3ep"},{"vulnerability":"VCID-avmn-kqky-83dd"},{"vulnerability":"VCID-ay6b-1a7z-qkas"},{"vulnerability":"VCID-b8fw-ya7y-h7d8"},{"vulnerability":"VCID-bq2j-t19h-zyad"},{"vulnerability":"VCID-ckvk-xm4a-2qey"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-deks-ns51-nbdg"},{"vulnerability":"VCID-dhwb-tvs2-vkht"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-e12q-qavs-qybu"},{"vulnerability":"VCID-e8un-nbkk-cbf9"},{"vulnerability":"VCID-edfu-7ege-hkf5"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-es39-uyu2-myap"},{"vulnerability":"VCID-hay8-hvsq-33bm"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-j7bj-atys-qfg3"},{"vulnerability":"VCID-jb63-xjup-1khv"},{"vulnerability":"VCID-jrhg-3271-tqdy"},{"vulnerability":"VCID-ks17-b29e-73au"},{"vulnerability":"VCID-kzrs-mrga-nyej"},{"vulnerability":"VCID-mm13-6dhq-nqfb"},{"vulnerability":"VCID-myja-t33q-q3cv"},{"vulnerability":"VCID-n5n3-p5yy-13d9"},{"vulnerability":"VCID-nacy-y1qt-5yhb"},{"vulnerability":"VCID-ng6g-hvc2-bkg4"},{"vulnerability":"VCID-nwdx-mgsc-s3f3"},{"vulnerability":"VCID-p54u-b18k-jyft"},{"vulnerability":"VCID-pgnc-fq4m-3kaz"},{"vulnerability":"VCID-pmmq-8s2m-h7dp"},{"vulnerability":"VCID-pnme-dc73-efcb"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-q6zh-decq-bkau"},{"vulnerability":"VCID-qj1a-e46b-b7fs"},{"vulnerability":"VCID-qsuc-53pg-zkda"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-rsc6-y1uv-6bfq"},{"vulnerability":"VCID-t5ya-jzjf-ckh6"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-ta99-gcmk-2qc8"},{"vulnerability":"VCID-tbhc-6qre-7kc5"},{"vulnerability":"VCID-tbk2-zprq-27c8"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-ughj-q27r-yfe2"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-uvmv-j9kx-jfeq"},{"vulnerability":"VCID-vz31-7246-aken"},{"vulnerability":"VCID-w4ks-ufnz-vfav"},{"vulnerability":"VCID-wapd-e3mu-sffn"},{"vulnerability":"VCID-wgac-uvfw-8ufm"},{"vulnerability":"VCID-wsv7-je8g-sqet"},{"vulnerability":"VCID-wszp-2es5-z7fy"},{"vulnerability":"VCID-x34m-u169-1bce"},{"vulnerability":"VCID-x36p-1a6e-rqad"},{"vulnerability":"VCID-y1nb-prqc-suaj"},{"vulnerability":"VCID-y5mz-1wsc-w3g7"},{"vulnerability":"VCID-ydy1-x277-1fhj"},{"vulnerability":"VCID-yq4q-hydz-vuga"},{"vulnerability":"VCID-yygb-pp11-5udj"},{"vulnerability":"VCID-z2xs-z24v-c3e5"},{"vulnerability":"VCID-zpeb-7dhc-9kcx"},{"vulnerability":"VCID-zqer-y4s4-hqhy"},{"vulnerability":"VCID-zvtm-9bd5-ufgy"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/80628?format=json","purl":"pkg:composer/drupal/core@8.8.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-31qy-vagp-83b6"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-9rmk-e8zd-9bcw"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-avmn-kqky-83dd"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-nacy-y1qt-5yhb"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-sg4r-hncm-dqcq"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"},{"vulnerability":"VCID-zr84-4jzv-2fd3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.8"},{"url":"http://public2.vulnerablecode.io/api/packages/80629?format=json","purl":"pkg:composer/drupal/core@8.9.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-31qy-vagp-83b6"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-9rmk-e8zd-9bcw"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-avmn-kqky-83dd"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-nacy-y1qt-5yhb"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-sg4r-hncm-dqcq"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"},{"vulnerability":"VCID-zr84-4jzv-2fd3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.1"},{"url":"http://public2.vulnerablecode.io/api/packages/80630?format=json","purl":"pkg:composer/drupal/core@9.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-31qy-vagp-83b6"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-9rmk-e8zd-9bcw"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-avmn-kqky-83dd"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-nacy-y1qt-5yhb"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-sg4r-hncm-dqcq"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"},{"vulnerability":"VCID-zr84-4jzv-2fd3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.1"}],"aliases":["CVE-2020-13663","GHSA-m648-hpf8-qcjw"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vz31-7246-aken"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/54439?format=json","vulnerability_id":"VCID-x783-ggg8-auck","summary":"Incorrect Authorization\nAccess bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13665","reference_id":"","reference_type":"","scores":[{"value":"0.00581","scoring_system":"epss","scoring_elements":"0.69303","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00581","scoring_system":"epss","scoring_elements":"0.69343","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13665"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13665.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13665.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13665.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13665.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2020-006","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-006"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13665","reference_id":"CVE-2020-13665","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13665"},{"reference_url":"https://github.com/advisories/GHSA-wxqp-jwc9-g39x","reference_id":"GHSA-wxqp-jwc9-g39x","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wxqp-jwc9-g39x"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/80628?format=json","purl":"pkg:composer/drupal/core@8.8.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-31qy-vagp-83b6"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-9rmk-e8zd-9bcw"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-avmn-kqky-83dd"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-nacy-y1qt-5yhb"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-sg4r-hncm-dqcq"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"},{"vulnerability":"VCID-zr84-4jzv-2fd3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.8"},{"url":"http://public2.vulnerablecode.io/api/packages/80629?format=json","purl":"pkg:composer/drupal/core@8.9.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2fas-m6vh-myhc"},{"vulnerability":"VCID-2t34-82p3-73c3"},{"vulnerability":"VCID-31qy-vagp-83b6"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-7v89-2sss-hfaz"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-9rmk-e8zd-9bcw"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-avmn-kqky-83dd"},{"vulnerability":"VCID-dav9-pgdh-8yey"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-nacy-y1qt-5yhb"},{"vulnerability":"VCID-pzp5-2bpz-jfe2"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-sg4r-hncm-dqcq"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"},{"vulnerability":"VCID-zr84-4jzv-2fd3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.9.1"},{"url":"http://public2.vulnerablecode.io/api/packages/80630?format=json","purl":"pkg:composer/drupal/core@9.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-31qy-vagp-83b6"},{"vulnerability":"VCID-3xk4-qwaq-5yaj"},{"vulnerability":"VCID-54qh-fz2a-cyh6"},{"vulnerability":"VCID-5jy9-mhbb-nuh7"},{"vulnerability":"VCID-67da-qxh5-aydx"},{"vulnerability":"VCID-9dfs-rpqy-6kfa"},{"vulnerability":"VCID-9rmk-e8zd-9bcw"},{"vulnerability":"VCID-a7ss-tkb6-gkge"},{"vulnerability":"VCID-ard5-3cjv-1beu"},{"vulnerability":"VCID-avmn-kqky-83dd"},{"vulnerability":"VCID-bge7-rqsx-gfee"},{"vulnerability":"VCID-dyhz-g3nv-yuc3"},{"vulnerability":"VCID-egtv-y9w1-skgr"},{"vulnerability":"VCID-hkch-a5yn-jyg1"},{"vulnerability":"VCID-nacy-y1qt-5yhb"},{"vulnerability":"VCID-rd4g-h1j9-23cb"},{"vulnerability":"VCID-sg4r-hncm-dqcq"},{"vulnerability":"VCID-t89y-c9hq-9bhk"},{"vulnerability":"VCID-tpzm-u3qp-akc8"},{"vulnerability":"VCID-uq9s-79g7-rqh6"},{"vulnerability":"VCID-wsv7-je8g-sqet"},{"vulnerability":"VCID-zr84-4jzv-2fd3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@9.0.1"}],"aliases":["CVE-2020-13665","GHSA-wxqp-jwc9-g39x"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-x783-ggg8-auck"}],"risk_score":"10.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/core@8.8.8"}