Drupal Core vulnerabilities

• drupal core Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016 CVE-2026-108514 Fix available 6.5 MediumOctober 14, 2026
• drupal core Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015 CVE-2026-108515 Fix available 6.5 MediumOctober 14, 2026
• drupal core Drupal core - Critical - Remote code execution - SA-CORE-2026-014 CVE-2026-108097 Public exploitFix available 8.1 HighOctober 14, 2026
• drupal core Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012 CVE-2026-55805 Fix available 5.4 MediumJuly 15, 2026
• drupal core Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011 CVE-2026-15917 Fix available 4.7 MediumJuly 15, 2026
• drupal core Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010 CVE-2026-15916 Fix available 4.2 MediumJuly 15, 2026
• drupal, drupal core +1 more Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009 CVE-2026-55808 Fix available 5.4 MediumJune 17, 2026
• drupal, drupal core +1 more Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008 CVE-2026-55807 Fix available 3.1 LowJune 17, 2026
• drupal, drupal core +1 more Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007 CVE-2026-55806 Fix available 5.9 MediumJune 17, 2026
• drupal, drupal core +1 more Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006 CVE-2026-55804 Fix available 5.9 MediumJune 17, 2026
• drupal, drupal core +1 more Drupal core - Critical - PHP object injection - SA-CORE-2026-005 CVE-2026-55803 Fix available 5.9 MediumJune 17, 2026
• drupal, drupal core +1 more Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003 CVE-2026-6367 Fix available 6.1 MediumApril 15, 2026
• drupal, drupal core +1 more Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008 CVE-2025-13083 Fix available 3.7 LowNovember 12, 2025
• drupal, drupal core +1 more Drupal core - Moderately critical - Defacement - SA-CORE-2025-007 CVE-2025-13082 Fix available 4.3 MediumNovember 12, 2025
• drupal, drupal core +1 more Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006 CVE-2025-13081 Fix available 5.9 MediumNovember 12, 2025
• drupal, drupal core +1 more Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005 CVE-2024-55635 Fix available 6.1 MediumDecember 9, 2024
• drupal, drupal core +1 more Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002 CVE-2024-11942 Fix available 5.9 MediumOctober 16, 2024
• drupal core, drupal +1 more Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 CVE-2026-9082 In KEVPublic exploitFix available EPSS 89.4% 9.8 CriticalFebruary 12, 2024
• drupal, drupal core +1 more Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002 CVE-2026-6366 Fix available 6.6 MediumFebruary 12, 2024
• drupal, drupal core +1 more Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001 CVE-2026-6365 Fix available 6.1 MediumFebruary 12, 2024
• drupal, drupal core, link +2 more Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004 CVE-2025-31675 Fix available 5.4 MediumFebruary 12, 2024
• drupal, drupal core +1 more Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003 CVE-2025-31674 Fix available 7.5 HighFebruary 12, 2024
• drupal, drupal core +1 more Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002 CVE-2025-31673 Fix available 4.6 MediumFebruary 12, 2024
• drupal, drupal core +1 more Drupal core - Critical - Cross site scripting - SA-CORE-2025-001 CVE-2025-3057 Fix available 6.1 MediumFebruary 12, 2024
• drupal, drupal core +1 more Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005 CVE-2025-13080 Fix available 5.3 MediumFebruary 12, 2024
• drupal, drupal core +1 more Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008 CVE-2024-55638 Fix available 9.8 CriticalFebruary 12, 2024
• drupal, drupal core +1 more Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007 CVE-2024-55637 Fix available 9.8 CriticalFebruary 12, 2024
• drupal, drupal core +1 more Drupal core - Less critical - Gadget chain - SA-CORE-2024-006 CVE-2024-55636 Fix available 9.8 CriticalFebruary 12, 2024
• drupal, drupal core +1 more Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004 CVE-2024-55634 Fix available 8.1 HighFebruary 12, 2024
• drupal, drupal core +1 more Drupal core Denial of Service vulnerability CVE-2024-45440 Public exploitFix available 5.3 MediumFebruary 12, 2024
• drupal, drupal core +1 more Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003 CVE-2024-12393 Fix available 5.4 MediumFebruary 12, 2024
• drupal, drupal core +1 more Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001 CVE-2024-11941 Fix available 7.5 HighJanuary 17, 2024
• drupal, drupal core, fedoraproject fedora +2 more Drupal core Unrestricted Upload of File with Dangerous Type CVE-2020-13671 In KEVPublic exploitFix available EPSS 36.2% 8.8 HighNovember 18, 2020
• drupal, drupal core +1 more Drupal Core Access bypass vulnerability CVE-2020-13667 Fix available 5.3 MediumSeptember 16, 2020
• drupal, drupal core +1 more Drupal Core Cross-site scripting vulnerability CVE-2020-13688 Fix available 6.1 MediumSeptember 16, 2020
• drupal, drupal core +1 more Drupal Core Cross-site scripting vulnerability CVE-2020-13666 Fix available 6.1 MediumSeptember 16, 2020
• drupal, drupal core +1 more Drupal Core Access bypass vulnerability CVE-2020-13665 Fix available 9.8 CriticalJune 17, 2020
• drupal, drupal core +1 more Drupal Core Arbitrary PHP code execution vulnerability CVE-2020-13664 Public exploitFix available 8.8 HighJune 17, 2020
• drupal, drupal core +1 more Drupal Core Cross-Site Request Forgery (CSRF) vulnerability CVE-2020-13663 Fix available 8.8 HighJune 17, 2020
• drupal, drupal core +1 more Drupal Core Open Redirect vulnerability CVE-2020-13662 Fix available 6.1 MediumMay 26, 2020
• drupal, debian linux, drupal core +2 more +4 more An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the... CVE-2011-2726 7.5 HighNovember 15, 2019
• drupal, drupal core +1 more Drupal core - Critical - Access bypass - SA-CORE-2019-008 CVE-2019-6342 Fix available 9.8 CriticalJuly 17, 2019
• drupal, drupal core, debian linux +1 more +3 more Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004 CVE-2019-6341 Fix available EPSS 12.2% 5.4 MediumMarch 20, 2019
• drupal core, drupal +1 more Drupal core - Highly critical - Remote Code Execution CVE-2019-6340 In KEVPublic exploitFix available EPSS 92.0% 8.1 HighFebruary 20, 2019
• drupal, drupal core +1 more Access bypass in Drupal 8 views CVE-2017-6923 Fix available 6.5 MediumJanuary 22, 2019
• drupal, drupal core, debian linux +2 more PHAR stream wrapper Arbitrary PHP code execution CVE-2019-6339 Public exploitFix available EPSS 35.9% 9.8 CriticalJanuary 16, 2019
• drupal, drupal core, debian linux +2 more third-party PEAR Archive_Tar library updates CVE-2019-6338 Fix available 8.0 HighJanuary 16, 2019
• drupal, drupal core +1 more File REST resource does not properly validate CVE-2017-6921 Fix available 5.9 MediumJanuary 15, 2019
• drupal, drupal core +1 more REST API can bypass comment approval - Access Bypass - Moderately Critical CVE-2017-6924 Fix available 7.4 HighJanuary 15, 2019
• drupal, drupal core, drupal.org drupal core +2 more Drupal PECL YAML parser unsafe object handling CVE-2017-6920 Fix available EPSS 20.2% 9.8 CriticalAugust 6, 2018
• Show olderLoading…