Drupal Drupal Core

• CVE-2026-9082 Critical 9.8 Exploited Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 89.4%
• CVE-2020-13671 High 8.8 Exploited Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP fo 36.2%
• CVE-2019-6340 High 8.1 Exploited Drupal core - Highly critical - Remote Code Execution 92.0%
• CVE-2026-108097 Unrated Drupal core - Critical - Remote code execution - SA-CORE-2026-014 0.3%
• CVE-2026-108515 Unrated Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015 0.2%
• CVE-2026-108514 Unrated Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016 0.2%
• CVE-2026-15916 Medium 4.2 Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010 0.2%
• CVE-2026-15917 Medium 4.7 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011 0.2%
• CVE-2026-55805 Medium 5.4 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012 0.2%
• CVE-2026-55808 Medium 5.4 Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009 0.3%
• CVE-2026-55807 Low 3.1 Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008 0.2%
• CVE-2026-55806 Medium 5.9 Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007 0.3%
• CVE-2026-55804 Medium 5.9 Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006 0.4%
• CVE-2026-55803 Medium 5.9 Drupal core - Critical - PHP object injection - SA-CORE-2026-005 0.4%
• CVE-2026-6367 Medium 6.1 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003 0.2%
• CVE-2026-6366 Medium 6.6 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002 0.4%
• CVE-2026-6365 Medium 6.1 Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001 0.2%
• CVE-2025-13083 Low 3.7 Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008 0.3%
• CVE-2025-13082 Medium 4.3 Drupal core - Moderately critical - Defacement - SA-CORE-2025-007 0.2%
• CVE-2025-13081 Medium 5.9 Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006 0.3%
• CVE-2025-13080 Medium 5.3 Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005 0.3%
• CVE-2025-31675 Medium 5.4 Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004 0.5%
• CVE-2025-31674 High 7.5 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003 0.6%
• CVE-2025-31673 Medium 4.6 Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002 0.3%
• CVE-2025-3057 Medium 6.1 Drupal core - Critical - Cross site scripting - SA-CORE-2025-001 0.3%
• CVE-2024-55638 Critical 9.8 Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008 1.0%
• CVE-2024-55637 Critical 9.8 Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007 0.8%
• CVE-2024-55636 Critical 9.8 Drupal core - Less critical - Gadget chain - SA-CORE-2024-006 0.9%
• CVE-2024-55635 Medium 6.1 Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005 0.3%
• CVE-2024-55634 High 8.1 Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004 0.4%
• CVE-2024-12393 Medium 5.4 Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003 0.3%
• CVE-2024-11942 Medium 5.9 Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002 0.4%
• CVE-2024-11941 High 7.5 Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001 0.5%
• CVE-2024-45440 Medium 5.3 core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist. 9.3%
• CVE-2020-13688 Unrated Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal 0.7%
• CVE-2020-13663 Unrated Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities. 0.7%
• CVE-2020-13667 Unrated Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switchi 0.9%
• CVE-2020-13664 Unrated Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully 3.0%
• CVE-2020-13662 Unrated Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal 0.9%
• CVE-2020-13665 Unrated Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue 1.3%
• CVE-2020-13666 Unrated Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8 2.9%