CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
Drupal has 891 CVEs, 5 exploited. Pick a weakness or a product to list them.
By weakness
- Cross-site Scripting260
- Access Control205
- Authentication62
- Cross-Site Request Forgery55
- Information Disclosure38
- Input Validation and Logic37 · 1 exploited
- Deserialization and Object Injection25 · 1 exploited
- SQL Injection24 · 1 exploited
- Command and Code Injection22 · 1 exploited
- Denial of Service10
- Open Redirect9
- Cryptography8
- Server-Side Request Forgery8
- File and Path Handling6 · 1 exploited
- Other weaknesses5
- Memory Corruption4
- Injection and Smuggling3
- Misconfiguration and Insecure Design2
- Supply Chain and Malicious Code1
- No weakness recorded107
By product
- Drupal166
- Drupal Core52 · 3 exploited
- Webform20
- core19 · 1 exploited
- AI (Artificial Intelligence)18
- SAML SSO - Service Provider13
- Open Social8
- Commerce Core7
- Enterprise MFA - TFA for Drupal6
- Aggregation Module4
- COOKiES Consent Management4
- Drupal Canvas4
- Everyblog4
- Monster Menus4
- Print4
- Project4
- Two-factor Authentication (TFA)4
- Authenticator Login3
- Commerce Stripe3
- Content Construction Kit3
- Disable Login Page3
- Facets3
- Gammu SMS Daemon3
- Login Disable3
- One Time Password3
- OpenID Connect / OAuth client3
- Shindig-Integrator3
- Single Content Sync3
- Tagify3
- Ubercart Module3
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.