Drupal Drupal Core vulnerabilities
52 published CVEs name Drupal Drupal Core among the affected products; CISA lists 3 of them as exploited in the wild.
- 52Published CVEs52 of them scored
- 19Last 12 monthspublished in the last year
- 7Critical13 more rated high
- 3Known exploitedin CISA's KEV catalog
Known exploited
Newest addition to KEV first.
- CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Drupal · Drupal core
ExploitedCritical9.8 - CVE-2019-6340
Drupal core - Highly critical - Remote Code Execution
Drupal · Drupal Core
ExploitedHigh8.1 - CVE-2020-13671
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as…
Drupal · Drupal Core
ExploitedHigh8.8