Drupal vulnerabilities

576 published CVEs name Drupal among the affected products; CISA lists 4 of them as exploited in the wild.

Critical 40High 100Medium 387Low 48Not scored 1

CVEs per yearBy the year they were published

CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Drupal · Drupal core
ExploitedCritical9.8
CVE-2018-7602
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
Drupal · core
ExploitedHigh8.1
CVE-2019-6340
Drupal core - Highly critical - Remote Code Execution
Drupal · Drupal Core
ExploitedHigh8.1
CVE-2020-13671
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as…
Drupal · Drupal Core
ExploitedHigh8.8

CVE-2026-110176
File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers
Drupal · File Force Download
High8.7
CVE-2026-77152
Field Collection for Drupal 7 access bypass via missing parent entity access check
Drupal · Field Collection for Drupal 7
Medium5.3
CVE-2026-107249
Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192
Drupal · Block AJAX
Critical9.8
CVE-2026-107250
ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193
Drupal · ECA Helper
Medium5.9
CVE-2026-107251
Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194
Drupal · Entity Reference Manager (Merge entities)
Medium6.5
CVE-2026-107252
MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195
Drupal · MathJax: LaTeX for Drupal
Medium5.4
CVE-2026-107253
Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196
Drupal · Orphans Media
Medium5.9
CVE-2026-107254
Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197
Drupal · Authenticator Login Plus (2FA)
Medium4.8
CVE-2026-107257
Actstream - Critical - Access bypass - SA-CONTRIB-2026-198
Drupal · Actstream
Medium6.5
CVE-2026-107258
Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199
Drupal · Inline Entity Form Dialog
Medium5.4