Drupal

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 9.8CriticalMay 22, 2026Drupal Core SQL injectionCVE-2026-9082Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.Added to KEV May 22, 2026Exploited89% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 8.1HighJul 19, 2018Drupal Core Code / command injectionCVE-2018-7602A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.Added to KEV Apr 13, 2022 · 1,363 days after publicationExploited99% likelyExploit codeExploit-DB · NucleiDetection
• 8.1HighFeb 21, 2019Drupal Core DeserializationCVE-2019-6340In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.Added to KEV Mar 25, 2022 · 1,127 days after publicationExploited92% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 8.8HighNov 20, 2020Drupal core Path traversal / file handlingCVE-2020-13671Improper sanitization in the extension file names is present in Drupal core.Added to KEV Jan 18, 2022 · 423 days after publicationExploited36% likelyExploit code
• 9.8CriticalMar 29, 2018Drupal Core Code / command injectionCVE-2018-7600Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.Added to KEV Nov 3, 2021 · 1,315 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

Recent

• 6.4MediumOct 22, 2026Drupal Cloud Code / command injectionCVE-2026-96376Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.
• 9.1CriticalOct 22, 2026Drupal Webform Code / command injectionCVE-2026-96355Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
• –UnscoredOct 15, 2026DrupalADV-cccs-70463fbda5a4Serial number: AV26-1047 Date: October 15, 2026 As of October 14, 2026, Drupal is affected by vulnerabilities in the following product: Drupal core Prior to 11.4.10 Prior to 11.3.19 Prior to 10.6.19 The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates or perform the suggested mitigations. Drupal core Critical - Remote code execution SA-CORE-2026-014 Drupal Security Advisories
• 9.8CriticalMay 22, 2026Drupal Core SQL injectionCVE-2026-9082Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.Exploited89% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 8.1HighJul 19, 2018Drupal Core Code / command injectionCVE-2018-7602A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.Exploited99% likelyExploit codeExploit-DB · NucleiDetection
• 8.1HighFeb 21, 2019Drupal Core DeserializationCVE-2019-6340In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.Exploited92% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 8.8HighNov 20, 2020Drupal core Path traversal / file handlingCVE-2020-13671Improper sanitization in the extension file names is present in Drupal core.Exploited36% likelyExploit code
• 9.8CriticalMar 29, 2018Drupal Core Code / command injectionCVE-2018-7600Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

See every Drupal entry on the dashboard.

Top products

• Webform1 CVE in the last year, 1 critical
• Core1 CVE in the last year, 1 critical, 1 exploited
• Cloud1 CVE in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• CCCS (Canada) · Oct 15, 2026Drupal security advisory (AV26-1047)ADV-cccs-70463fbda5a4