Product by Drupal
Drupal Core
58 known vulnerabilities in Drupal Core (Drupal), 3 of them actively exploited (CISA KEV).
Key figures
58
Vulnerabilities
3
Actively exploited (KEV)
0
Used by ransomware
10
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2026-9082 | Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 In CISA KEV | 9.8 | |
| Critical | CVE-2020-13671 | Drupal core Un-restricted Upload of File In CISA KEV | 8.8 | |
| Critical | CVE-2019-6340 | Drupal core - Highly critical - Remote Code Execution In CISA KEV | 8.1 | |
| Critical | CVE-2019-6339 | PHAR stream wrapper Arbitrary PHP code execution | 9.8 | |
| Critical | CVE-2017-6920 | Drupal.org Drupal Core: Code Execution | 9.8 | |
| High | CVE-2017-6381 | Drupal Core: Remote Code Execution | 8.1 | |
| Medium | CVE-2024-45440 | Drupal core: security vulnerability | 5.3 | |
| High | CVE-2020-13664 | Drupal Core: Remote Code Execution | 8.8 | |
| Critical | CVE-2019-6342 | Drupal core - Critical - Access bypass - SA-CORE-2019-008 | 9.8 | |
| Medium | CVE-2019-6341 | Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004 | 5.4 | |
| High | CVE-2019-6338 | third-party PEAR Archive_Tar library updates | 8.0 | |
| Medium | CVE-2020-13666 | Drupal Core: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2017-6924 | REST API can bypass comment approval - Access Bypass - Moderately Critical | 7.4 | |
| High | CVE-2017-6377 | Drupal Core: security vulnerability | 7.5 | |
| Critical | CVE-2020-13665 | Drupal Core: security vulnerability | 9.8 | |
| Critical | CVE-2024-55638 | Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008 | 9.8 | |
| Critical | CVE-2024-55636 | Drupal core - Less critical - Gadget chain - SA-CORE-2024-006 | 9.8 | |
| Medium | CVE-2017-6923 | Access bypass in Drupal 8 views | 6.5 | |
| Medium | CVE-2017-6922 | Drupal Core: security vulnerability | 6.5 | |
| High | CVE-2011-2726 | drupal core: security vulnerability | 7.5 | |
| Critical | CVE-2024-55637 | Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007 | 9.8 | |
| High | CVE-2017-6930 | Drupal.org Drupal Core: security vulnerability | 8.1 | |
| Medium | CVE-2017-6921 | File REST resource does not properly validate | 5.9 | |
| High | CVE-2017-6926 | Drupal.org Drupal Core: security vulnerability | 8.1 | |
| Medium | CVE-2017-6927 | Drupal.org Drupal Core: Cross-Site Scripting (XSS) | 6.1 |
News
- Drupal Critical SQL Injection Flaw Exploitedsans-newsbites-mail,
- Fwd: @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 21sans-atrisk,
- Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEVthehackernews,
- Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacksthehackernews,
- Vulnérabilité dans Drupal (21 mai 2026)cert-fr,