Access Control

Every one of the 205 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Drupal LocalGov Workflows < 1.6.0 - Information DisclosureCVE-2026-10768Drupal · CVSS 9.8 · 2.1% likely

   CWE-862

2. Drupal Commerce Core < 3.3.13 / < 8.x-2.41 - Guest Cart Admin Access BypassCVE-2026-118539Drupal · CVSS 6.5 · 0.7% likelycovered by CyberSIXT

   CWE-8626 articles

3. The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.CVE-2012-4554Drupal · 16% likely

   CWE-264

4. modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.CVE-2014-5267Drupal · 4.4% likely

   CWE-264

5. Drupal 7.x before 7.3 allows remote attackers to bypass intended node_access restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node ta…CVE-2011-2687Drupal · 3.1% likely

   CWE-264

6. The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user…CVE-2016-6211Drupal · 2.8% likely

   CWE-264

7. Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers to obtain sensitive information by reading the search results.CVE-2012-5651Drupal · 2.7% likely

   CWE-264

8. Unrestricted file upload vulnerability in the BlogAPI module in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote authenticated users to execute arbitrary code by uploading…CVE-2008-3742Drupal · 2.5% likely

   CWE-264

9. The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass up…CVE-2008-0569Drupal · 2.5% likely

   CWE-264

10. Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HT…CVE-2014-9015Drupal · 2.5% likely

    CWE-264

11. The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read privat…CVE-2012-1591Drupal · 2.4% likely

    CWE-264

12. The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function…CVE-2016-3169Drupal · 2.2% likely

    CWE-264

13. The node module API in Drupal 5.x before 5.11 allows remote attackers to bypass node validation and have unspecified other impact via unknown vectors related to contributed module…CVE-2008-4793Drupal · 2.2% likely

    CWE-264

14. The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read deriv…CVE-2013-0246Drupal · 2.1% likely

    CWE-264

15. REST API can bypass comment approval - Access Bypass - Moderately CriticalCVE-2017-6924Drupal · 2.1% likely

    CWE-269

16. Drupal 7.x before 7.16 allows remote attackers to obtain sensitive information and possibly re-install Drupal and execute arbitrary PHP code via an external database server, relat…CVE-2012-4553Drupal · 2.1% likely

    CWE-264

17. Access bypass in Drupal 8 viewsCVE-2017-6923Drupal · 2.0% likely

    CWE-862

18. Semantically-Interconnected Online Communities (SIOC) 5.x before 5.x-1.2 and 6.x before 6.x-1.1, a module for Drupal, does not properly implement menu and database APIs, which all…CVE-2008-6160Drupal · 1.9% likely

    CWE-264

19. When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.CVE-2017-6377Drupal · 1.9% likely

    CWE-863

20. The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not properly restrict access to node that are part of a book outli…CVE-2013-0245Drupal · 1.9% likely

    CWE-264

21. Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access…CVE-2012-2153Drupal · 1.9% likely

    CWE-264

22. The user module in Drupal 5.x before 5.11 and 6.x before 6.5 might allow remote authenticated users to bypass intended login access rules and successfully login via unknown vector…CVE-2008-4791Drupal · 1.8% likely

    CWE-264

23. The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended ac…CVE-2016-7572Drupal · 1.7% likely

    CWE-264

24. Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary node…CVE-2016-7570Drupal · 1.7% likely

    CWE-264

25. Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as anothe…CVE-2015-2559Drupal · 1.6% likely

    CWE-284

26. The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages, which allows remote attackers with the…CVE-2013-4226Drupal · 1.6% likely

    CWE-862

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.