DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
545
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 39High 72Medium 256Low 30
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-9082 In wildKEV | 9.8 | May 20 | Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 Affected: 8.9.0 before 10.4.10; 10.5.0 before 10.5.10; 10.6.0 before 10.6.9; 11.0.0 before 11.1.10; 11.2.0 before 11.2.12; 11.3.0 before 11.3.10 |
| CVE-2018-7602 RansomwareIn wildKEV | 9.8 | Jul 19 | Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 Affected: before 7.59; before 8.5.3; before 8.4.8 |
| CVE-2018-7600 RansomwareIn wildKEV | 9.8 | Mar 29 | Drupal Core Remote Code Execution Vulnerability Affected: through 7.57; 8.0.0 before 8.3.9; 8.4.0 before 8.4.6; 8.5.0 before 8.5.1 |
| CVE-2026-16639 | 9.8 | Aug 25 | Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081 Affected: 0.0.0 before 1.8.0 |
| CVE-2026-16641 | 9.8 | Aug 25 | Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084 Affected: *.* |
| CVE-2026-11913 | 9.8 | Jul 10 | Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045 Affected: *.* |
| CVE-2026-12535 | 9.8 | Jul 10 | Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048 Affected: 0.0.0 before 2.0.0 |
| CVE-2026-10768 | 9.8 | Jul 10 | LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039 Affected: 0.0.0 before 1.6.0 |
| CVE-2026-9726 | 9.8 | Jul 10 | Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038 Affected: 0.0.0 before 2.1.17 |
| CVE-2026-8495 | 9.8 | May 19 | Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037 Affected: 0.0.0 before 4.0.15 |
| CVE-2024-13285 | 9.8 | Jan 9 | wkhtmltopdf - Highly critical - Unsupported - SA-CONTRIB-2024-049 Affected: *.* |
| CVE-2024-13280 | 9.8 | Jan 9 | Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044 Affected: 0.0.0 before 1.8.0; 2.0.* before 2.2.2 |
| CVE-2024-13279 | 9.8 | Jan 9 | Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043 Affected: 0.0.0 before 1.8.0 |
| CVE-2024-13264 | 9.8 | Jan 9 | Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028 Affected: 0.0.0 before 3.1.2 |
| CVE-2024-13258 | 9.8 | Jan 9 | Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022 Affected: 0.0.0 before 2.0.13 |
| CVE-2024-13239 | 9.8 | Jan 9 | Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003 Affected: 0.0.0 before 1.5.0 |
| CVE-2024-55638 | 9.8 | Dec 10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from… Affected: 7.0 before 7.102; 8.0.0 before 10.2.11; 10.3.0 before 10.3.9 |
| CVE-2024-55637 | 9.8 | Dec 10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from… Affected: 8.0.0 before 10.2.11; 10.3.0 before 10.3.9; 11.0.0 before 11.0.8 |
| CVE-2024-55636 | 9.8 | Dec 10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from… Affected: 8.0.0 before 10.2.11; 10.3.0 before 10.3.9; 11.0.0 before 11.0.8 |
| CVE-2020-13675 | 9.8 | Feb 11 | Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs Affected: 8.0.0 before 8.9.19; 9.1.0 before 9.1.13; 9.2.0 before 9.2.6 |
| CVE-2020-13665 | 9.8 | May 5 | Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode Affected: 8.8.0 before 8.8.8; 8.9.0 before 8.9.1; 9.0.0 before 9.0.1 |
| CVE-2019-6342 | 9.8 | May 28 | An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled Affected: 8.7.4 |
| CVE-2011-2715 | 9.8 | Jan 14 | An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names Affected: 6.20 |
| CVE-2019-10910 | 9.8 | May 16 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection… Affected: 8.5.0 before 8.5.15; 8.6.0 before 8.6.15 |
| CVE-2019-11831 | 9.8 | May 9 | The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a… Affected: 7.0 before 7.67; 8.6.0 before 8.6.16; 8.7.0 before 8.7.1 |
| CVE-2019-6339 | 9.8 | Jan 22 | PHAR stream wrapper Arbitrary PHP code execution Affected: 7.x before 7.62; 8.6.x before 8.6.6.; 8.5.x before 8.5.9 |
| CVE-2017-6925 | 9.8 | Jan 15 | In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities Affected: 8.0.0 before 8.3.7 |
| CVE-2017-6920 | 9.8 | Aug 6 | Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations Affected: 8.0.0 before 8.3.4 |
| CVE-2026-96355 New | 9.1 | Oct 22 | Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175 Affected: 0.0.0 before 6.2.12; 6.3.0 before 6.3.1 |
| CVE-2026-73475 | 9.1 | Sep 2 | Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095 Affected: 0.0.0 before 1.12.0; 2.0.0 before 2.1.3 |
| CVE-2026-16644 | 9.1 | Aug 25 | Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087 Affected: 0.0.0 before 4.1.0 |
| CVE-2026-16645 | 9.1 | Aug 25 | PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088 Affected: 0.0.0 before 3.2.0 |
| CVE-2026-15089 | 9.1 | Jul 10 | Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079 Affected: *.* |
| CVE-2024-13281 | 9.1 | Jan 9 | Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045 Affected: 0.0.0 before 9.3.2 |
| CVE-2024-13278 | 9.1 | Jan 9 | Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042 Affected: 0.0.0 before 1.8.0 |
| CVE-2024-13277 | 9.1 | Jan 9 | Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041 Affected: 7.x-1.0 before 7.x-1.1 |
| CVE-2024-13253 | 9.1 | Jan 9 | Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017 Affected: 0.0.0 before 1.5.0 |
| CVE-2024-13242 | 9.1 | Jan 9 | Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006 Affected: *.* |
| CVE-2024-13241 | 9.1 | Jan 9 | Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005 Affected: 0.0.0 before 12.0.5 |
Showing 39
The 500 most important CVEs for this product (exploited first, then by severity)