Brand
Drupal: actively exploited vulnerabilities
5 vulnerabilities in Drupal products (Core) are in CISA’s catalog of exploited vulnerabilities. Last added: May 22, 2026.
The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).
-
1 vulnerability added in the last 12 months
-
5 exploited vulnerabilities in the catalog, in total
-
0 added in the last 30 days
By category
Add just one Drupal category to your radar, or open its page.
- CMS, e-commerce and websites 5 vulnerabilities
A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.
Affected products
- Core5 vulnerabilities, CMS and websites
Name used by CISA: Drupal. Product families: indicative classification by this site.
Patch first
In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Drupal list.
- Rank 1
Drupal CoreCVE-2026-9082
Drupal Core SQL Injection Vulnerability
CVSS severity 9.8critical
Added May 22, 2026
- Rank 2
Drupal CoreCVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
RansomwareCVE from 2018, added in 2022
CVSS severity 9.8critical
Added Apr 13, 2022
- Rank 3
Drupal CoreCVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
RansomwareCVE from 2018, added in 2021
CVSS severity 9.8critical
Added Nov 3, 2021
- Rank 4
Drupal CoreCVE-2020-13671
Drupal core Un-restricted Upload of File
CVE from 2020, added in 2022
CVSS severity 8.8high
Added Jan 18, 2022
- Rank 5
Drupal CoreCVE-2019-6340
Drupal Core Remote Code Execution Vulnerability
CVE from 2019, added in 2022
CVSS severity 8.1high
Added Mar 25, 2022
Follow and verify
Get new Drupal vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).
Indicative classification, based on the vendor and product names given by CISA. How products are classified.