Drupal Drupal Core vulnerabilities

CVEs per yearBy the year they were published

1. 20173
2. 20198
3. 20202
4. 20217
5. 20249
6. 20258
7. 202615

Known exploitedNewest addition to KEV first

• CVE-2026-9082

  Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

  Drupal · Drupal core

  ExploitedCritical9.8
• CVE-2019-6340

  Drupal core - Highly critical - Remote Code Execution

  Drupal · Drupal Core

  ExploitedHigh8.1
• CVE-2020-13671

  Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as…

  Drupal · Drupal Core

  ExploitedHigh8.8

Newest CVEs

• CVE-2026-108097

  Drupal core - Critical - Remote code execution - SA-CORE-2026-014

  Drupal · Drupal core

  Not scored
• CVE-2026-108515

  Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015

  Drupal · Drupal core

  Not scored
• CVE-2026-108514

  Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

  Drupal · Drupal core

  Not scored
• CVE-2026-15916

  Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

  Drupal · Drupal core

  Medium4.2
• CVE-2026-15917

  Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

  Drupal · Drupal core

  Medium4.7
• CVE-2026-55805

  Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

  Drupal · Drupal core

  Medium5.4
• CVE-2026-55808

  Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

  Drupal · Drupal core

  Medium5.4
• CVE-2026-55807

  Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

  Drupal · Drupal core

  Low3.1
• CVE-2026-55806

  Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

  Drupal · Drupal core

  Medium5.9
• CVE-2026-55804

  Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

  Drupal · Drupal core

  Medium5.9