DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
680
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 44High 108Medium 347Low 1
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-9082 In wildKEV | 9.8 | May 20 | Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 Affected: 8.9.0 before 10.4.10; 10.5.0 before 10.5.10; 10.6.0 before 10.6.9; 11.0.0 before 11.1.10; 11.2.0 before 11.2.12; 11.3.0 before 11.3.10 |
| CVE-2018-7602 RansomwareIn wildKEV | 9.8 | Jul 19 | Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 Affected: before 7.59; before 8.5.3; before 8.4.8 |
| CVE-2018-7600 RansomwareIn wildKEV | 9.8 | Mar 29 | Drupal Core Remote Code Execution Vulnerability Affected: through 7.57; 8.0.0 before 8.3.9; 8.4.0 before 8.4.6; 8.5.0 before 8.5.1 |
| CVE-2020-13671 In wildKEV | 8.8 | Nov 20 | Drupal core Un-restricted Upload of File Affected: 9.0 versions prior to 9.0.8; 8.9 versions prior to 8.9.9; 8.8 versions prior to 8.8.11; 7 versions prior to 7.74 |
| CVE-2019-6340 In wildKEV | 8.1 | Feb 21 | Drupal core - Highly critical - Remote Code Execution Affected: 8.5 before 8.5.11; 8.6 before 8.6.10 |
| CVE-2020-28949 In wildKEV | 7.8 | Nov 19 | PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability Affected: 7.0 before 7.75; 8.0.0 before 8.9.10; 8.8.0 before 8.8.12; 9.0.0 before 9.0.9 |
| CVE-2020-36193 In wildKEV | 7.5 | Jan 18 | PEAR Archive_Tar Improper Link Resolution Vulnerability Affected: 7.0 before 7.78; 8.9.0 before 8.9.13; 9.0.0 before 9.0.11; 9.1.0 before 9.1.3 |
| CVE-2020-11023 In wildKEV | 6.1 | Apr 29 | Potential XSS vulnerability in jQuery Affected: 7.0 before 7.70; 8.7.0 before 8.7.14; 8.8.0 before 8.8.6 |
Showing 8
The 500 most important CVEs for this product (exploited first, then by severity)