Skip to content

Exploit Radar Choose my productsProducts My radar

Products › Brands

Brand

Drupal: actively exploited vulnerabilities

5 vulnerabilities in Drupal products (Core) are in CISA’s catalog of exploited vulnerabilities. Last added: May 22, 2026.

Drupal security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

1 vulnerability added in the last 12 months
5 exploited vulnerabilities in the catalog, in total
0 added in the last 30 days

By category

Add just one Drupal category to your radar, or open its page.

CMS, e-commerce and websites 5 vulnerabilities

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

Core 5 vulnerabilities · CMS and websites

Name used by CISA: Drupal. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Drupal list.

Rank 1Drupal Core
CVE-2026-9082
Drupal Core SQL Injection Vulnerability
Added in the last 12 months: ranked by severity.
Added
May 22, 2026
CISA deadline
5 days
CVSS severity
9.8 (critical)
Rank 2Drupal Core
CVE-2018-7602
RansomwareCVE from 2018, added in 2022
Drupal Core Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Apr 13, 2022
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 3Drupal Core
CVE-2018-7600
RansomwareCVE from 2018, added in 2021
Drupal Core Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
9.8 (critical)
Rank 4Drupal Core
CVE-2020-13671
CVE from 2020, added in 2022
Drupal core Un-restricted Upload of File
Added more than a year ago: ranked by severity.
Added
Jan 18, 2022
CISA deadline
181 days
CVSS severity
8.8 (high)
Rank 5Drupal Core
CVE-2019-6340
CVE from 2019, added in 2022
Drupal Core Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Mar 25, 2022
CISA deadline
21 days
CVSS severity
8.1 (high)

Get new Drupal vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.