Input Validation and Logic

Every one of the 37 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Drupal - Remote Code ExecutionCVE-2018-7600Drupal · CVSS 9.8 · 100% likely

   CWE-201 bounty report

2. PHAR stream wrapper Arbitrary PHP code executionCVE-2019-6339Drupal · 36% likely

   CWE-20

3. The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file contents after SA-CORE-2…CVE-2014-5170Drupal · 3.8% likely

   CWE-20

4. The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining whi…CVE-2014-5019Drupal · 2.8% likely

   CWE-20

5. Unspecified vulnerability in the Meta Tags (aka Nodewords) 5.x-1.6 module for Drupal, when images are permitted in node bodies, allows remote authenticated users to execute arbitr…CVE-2008-0264Drupal · 2.1% likely

   CWE-20

6. Unspecified vulnerability in the Fileshare module for Drupal allows remote authenticated users with node-creation privileges to execute arbitrary code via unspecified vectors.CVE-2008-0277Drupal · 2.1% likely

   CWE-20

7. The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers,…CVE-2015-3234Drupal · 1.9% likely

   CWE-20

8. File REST resource does not properly validateCVE-2017-6921Drupal · 1.8% likely

   CWE-20

9. The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL.CVE-2016-9452Drupal · 1.7% likely

   CWE-20

10. The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a nul…CVE-2012-5653Drupal · 1.7% likely

    CWE-20

11. Open redirect vulnerability in the Form API in Drupal 7.x before 7.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted par…CVE-2012-1589Drupal · 1.4% likely

    CWE-20

12. Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to injec…CVE-2022-25271Drupal · 1.3% likely

    CWE-20

13. Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspe…CVE-2013-6389Drupal · 1.2% likely

    CWE-20

14. The OpenID 5.x-1.0 and earlier module for Drupal does not properly verify the claimed_id returned by an OpenID provider, which allows remote OpenID providers to spoof OpenID authe…CVE-2008-0570Drupal · 1.1% likely

    CWE-20

15. Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to injec…CVE-2022-25273Drupal · CVSS 7.5 · 0.6% likely

    CWE-20

16. Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084CVE-2026-16641Drupal · CVSS 9.8 · 0.5% likely

    CWE-20

17. Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004CVE-2024-55634Drupal · CVSS 8.1 · 0.4% likely

    CWE-178

18. Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002CVE-2024-11942Drupal · CVSS 5.9 · 0.4% likely

    CWE-390

19. Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038CVE-2024-13274Drupal · CVSS 5.3 · 0.4% likely

    CWE-799

20. Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101CVE-2026-76758Drupal · CVSS 5.9 · 0.3% likely

    CWE-20

21. Composer - Critical - Unsupported - SA-CONTRIB-2026-046CVE-2026-11914Drupal · CVSS 5.9 · 0.3% likely

    CWE-20

22. Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005CVE-2025-13080Drupal · CVSS 5.3 · 0.3% likely

    CWE-754

23. Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092CVE-2026-18261Drupal · CVSS 5.7 · 0.3% likely

    CWE-20

24. Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086CVE-2026-16643Drupal · CVSS 5.7 · 0.3% likely

    CWE-20

25. Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085CVE-2026-16642Drupal · CVSS 5.7 · 0.3% likely

    CWE-20

26. Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089CVE-2026-15088Drupal · CVSS 5.7 · 0.3% likely

    CWE-20

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.