Drupal
Core and contributed module records from public security advisories.
67 public records currently classified under this stack.
Known exploited
All KEV for Drupal- Critical9.8Drupal Core Remote Code Execution VulnerabilityKEVEPSS 100.0%Mar 29, 2018
- Critical9.8Drupal Core Remote Code Execution VulnerabilityKEVEPSS 99.2%Jul 19, 2018
- High8.1Drupal Core Remote Code Execution VulnerabilityKEVEPSS 92.0%Feb 21, 2019
- Medium6.1JQuery Cross-Site Scripting (XSS) VulnerabilityKEVEPSS 84.9%Apr 29, 2020
- High7.8PEAR Archive_Tar Deserialization of Untrusted Data VulnerabilityKEVEPSS 84.6%Nov 19, 2020
- High7.5PEAR Archive_Tar Improper Link Resolution VulnerabilityKEVEPSS 70.6%Jan 18, 2021
- High8.8Drupal core Un-restricted Upload of FileKEVEPSS 35.4%Nov 20, 2020
- Critical9.8Drupal Core SQL Injection VulnerabilityKEVEPSS 15.7%May 20, 2026
Recent Drupal findings
Full list- UnknownThe Entity List module provides a way to create lists of entities without Views.Oct 14, 2026
- UnknownThe Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.Oct 14, 2026
- UnknownThe Drupal core Link module provides a field type that can be used for internal and external URLs.Oct 14, 2026
- UnknownGin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators.Oct 14, 2026
- UnknownA remote code execution vulnerability exists within the Field UI module in Drupal core.Oct 14, 2026
- UnknownDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012Jul 15, 2026
- UnknownDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011EPSS 0.1%Jul 15, 2026
- UnknownDrupal core - Moderately critical - Information disclosure - SA-CORE-2026-010EPSS 0.1%Jul 15, 2026
- UnknownDrupal core - Moderately critical - Improper validation - SA-CORE-2026-009Jun 17, 2026
- UnknownDrupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008Jun 17, 2026