Drupal · product
Drupal Core
52 CVEs · 3 exploited
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 3
- check available
- 1
- likely to be exploited
- 2
Every one of the 52 is a mark on the map. Named now: 1 to 26, most at risk first.
- Drupal - Remote Code Execution
- Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query
- Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type…
- Drupal 11.x-dev - Full Path Disclosure
- PHAR stream wrapper Arbitrary PHP code execution
- Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004
- A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection agai…
- Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in…
- Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versio…
- Drupal core - Critical - Access bypass - SA-CORE-2019-008
- third-party PEAR Archive_Tar library updates
- REST API can bypass comment approval - Access Bypass - Moderately Critical
- Access bypass in Drupal 8 views
- Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
- When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.
- File REST resource does not properly validate
- Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are v…
- Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008
- Drupal core - Less critical - Gadget chain - SA-CORE-2024-006
- Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access per…
- Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue af…
- Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
- Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated…
- Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.
- Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This…
- Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.