Information Disclosure

Every one of the 38 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Drupal 11.x-dev - Full Path DisclosureCVE-2024-45440Drupal · CVSS 5.3 · 9.3% likely

   CWE-209

2. The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q[] parameter to index.php, which re…CVE-2012-2922Drupal · 3.0% likely

   CWE-200

3. Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.CVE-2015-6661Drupal · 2.8% likely

   CWE-200

4. Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed or (2) search result.CVE-2012-5652Drupal · 2.4% likely

   CWE-200

5. The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restriction…CVE-2016-6212Drupal · 2.2% likely

   CWE-200

6. The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by l…CVE-2016-3170Drupal · 2.1% likely

   CWE-200

7. Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX inf…CVE-2012-0825Drupal · 2.0% likely

   CWE-200

8. The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging incons…CVE-2016-9449Drupal · 1.9% likely

   CWE-200

9. The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed by user 1 by reading…CVE-2015-3231Drupal · 1.7% likely

   CWE-200

10. Drupal 7.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by…CVE-2011-3730Drupal · 1.7% likely

    CWE-200

11. Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim…CVE-2014-2983Drupal · 1.6% likely

    CWE-200

12. The Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to obtain sensitive event registration information by leveraging the "Register other accou…CVE-2015-7880Drupal · 1.4% likely

    CWE-200

13. Drupal core - Critical - Cache poisoning - SA-CORE-2023-006CVE-2023-5256Drupal · CVSS 7.5 · 0.9% likely

    CWE-200

14. RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019CVE-2024-13255Drupal · CVSS 7.5 · 0.5% likely

    CWE-202

15. Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023CVE-2024-13259Drupal · CVSS 7.5 · 0.5% likely

    CWE-201

16. REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018CVE-2024-13254Drupal · CVSS 7.5 · 0.5% likely

    CWE-201

17. Profile Private - Critical - Unsupported - SA-CONTRIB-2025-002CVE-2025-3059Drupal · CVSS 5.3 · 0.5% likely

    CWE-200

18. Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090CVE-2026-18259Drupal · CVSS 7.5 · 0.4% likely

    CWE-208

19. Information disclosure via file URI overwrite in File (Field) PathsCVE-2026-1556Drupal · CVSS 6.9 · 0.4% likely

    CWE-200

20. File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040CVE-2024-13276Drupal · CVSS 7.5 · 0.4% likely

    CWE-201

21. Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033CVE-2024-13269Drupal · CVSS 5.3 · 0.4% likely

    CWE-201

22. AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270CVE-2026-118550Drupal · CVSS 5.9 · 0.3% likely

    CWE-525

23. DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112CVE-2026-81162Drupal · CVSS 5.3 · 0.3% likely

    CWE-201

24. Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207CVE-2026-107268Drupal · CVSS 4.3 · 0.3% likely

    CWE-201

25. Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008CVE-2025-13083Drupal · CVSS 3.7 · 0.3% likely

    CWE-525

26. Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106CVE-2026-81159Drupal · CVSS 3.7 · 0.3% likely

    CWE-208

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.