DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
680
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 44High 108Medium 347Low 1
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-76759 | 7.3 | Sep 2 | Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 Affected: *.* |
| CVE-2025-48920 | 7.3 | Jun 13 | etracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074 Affected: 0.0.0 before 3.1.0 |
| CVE-2025-3904 | 7.3 | Apr 23 | Sportsleague - Critical - Unsupported - SA-CONTRIB-2025-045 Affected: *.* |
| CVE-2025-3903 | 7.3 | Apr 23 | UEditor - 百度编辑器 - Critical - Unsupported - SA-CONTRIB-2025-044 Affected: *.* |
| CVE-2024-13311 | 7.3 | Jan 9 | Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075 Affected: *.* |
| CVE-2024-13291 | 7.3 | Jan 9 | Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057 Affected: 7.x-1.0 before 7.x-1.4 |
| CVE-2022-25277 | 7.2 | Apr 26 | Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server… Affected: 8.0.0 before 9.3.19; 9.4.0 before 9.4.3 |
| CVE-2025-48447 | 7.1 | Jun 11 | Lightgallery - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-069 Affected: 0.0.0 before 1.6.0 |
The 500 most important CVEs for this product (exploited first, then by severity)