core

Every one of the 19 is a mark on the map. Named now: 1 to 19, most at risk first.

1. Drupal - Remote Code ExecutionCVE-2018-7602Drupal · CVSS 8.1 · 99% likely

   CWE-94

2. Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server…CVE-2022-25277Drupal · CVSS 7.2 · 1.4% likely

   CWE-434

3. Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerabili…CVE-2020-13675Drupal · 1.4% likely

   CWE-284

4. Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to injec…CVE-2022-25271Drupal · 1.3% likely

   CWE-20

5. Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not hav…CVE-2020-13677Drupal · 1.2% likely

   CWE-284

6. Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access…CVE-2020-13670Drupal · 1.1% likely

   CWE-668

7. Drupal core - Critical - Cache poisoning - SA-CORE-2023-006CVE-2023-5256Drupal · CVSS 7.5 · 0.9% likely

   CWE-200

8. The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdi…CVE-2020-13676Drupal · 0.8% likely

   CWE-284

9. Access bypass in Drupal Core 8/9CVE-2020-13668Drupal · 0.8% likely

   CWE-79

10. The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content th…CVE-2022-25270Drupal · 0.8% likely

    CWE-863

11. Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions…CVE-2020-13669Drupal · 0.7% likely

    CWE-79

12. Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Co…CVE-2020-13672Drupal · 0.7% likely

    CWE-79

13. In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the i…CVE-2022-25275Drupal · CVSS 7.5 · 0.7% likely
14. Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. N…CVE-2022-25278Drupal · CVSS 6.5 · 0.6% likely
15. Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to injec…CVE-2022-25273Drupal · CVSS 7.5 · 0.6% likely

    CWE-20

16. Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005CVE-2023-31250Drupal · CVSS 6.5 · 0.5% likely

    CWE-863

17. The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circums…CVE-2022-25276Drupal · CVSS 6.1 · 0.5% likely

    CWE-79

18. The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues.…CVE-2020-13674Drupal · 0.5% likely

    CWE-352

19. Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible acce…CVE-2022-25274Drupal · CVSS 5.4 · 0.4% likely

    CWE-863

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.