Drupal
Number 37 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: Drupal, drupal
Total vulnerabilities
577
Critical
35
High
90
Known Exploited
4
Exploit available
5
Network, no login needed
55.6%
Of 543 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 327 | 15 | 33 | 237 | 41 | 1 |
| 2025 | 196 | 17 | 48 | 124 | 7 | 0 |
| 2024 | 10 | 3 | 2 | 5 | 0 | 0 |
| 2023 | 8 | 0 | 4 | 4 | 0 | 0 |
| 2022 | 11 | 0 | 0 | 0 | 0 | 11 |
| 2021 | 7 | 0 | 0 | 0 | 0 | 7 |
| 2020 | 4 | 0 | 1 | 0 | 0 | 3 |
| 2019 | 10 | 0 | 1 | 0 | 0 | 9 |
| 2018 | 1 | 0 | 1 | 0 | 0 | 0 |
| 2017 | 3 | 0 | 0 | 0 | 0 | 3 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| Drupal core | 28 | 3 |
| Drupal Core | 24 | 7 |
| Webform | 20 | 2 |
| AI (Artificial Intelligence) | 18 | 5 |
| Core | 18 | 4 |
| SAML SSO - Service Provider | 13 | 1 |
| Open Social | 8 | 5 |
| Commerce Core | 7 | 0 |
| Enterprise MFA - TFA for Drupal | 6 | 3 |
| COOKiES Consent Management | 4 | 3 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Cross-Site Scripting | 155 | 15 |
| Incorrect Authorization | 72 | 17 |
| Missing Authorization | 54 | 11 |
| Authentication Issues | 41 | 9 |
| Cross-Site Request Forgery | 35 | 13 |
| Improperly Controlled Modification of Dynamically-Determined Object Attributes | 16 | 11 |
| Improper Input Validation | 10 | 2 |
| Privilege Defined With Unsafe Actions | 10 | 1 |
| Server-Side Request Forgery | 8 | 0 |
| Use of Web Browser Cache Containing Sensitive Information | 8 | 0 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-9082 | Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 | Critical | 89.4% | |
| CVE-2020-13671 | Drupal Core: Unrestricted File Upload | High | 36.2% | |
| CVE-2019-6340 | Drupal core - Highly critical - Remote Code Execution | High | 92.0% | |
| CVE-2018-7602 | Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 | High | 99.2% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-110176 | File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers | High | 0.2% | |
| CVE-2026-96389 | Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206 | Medium | 0.2% | |
| CVE-2026-77152 | Field Collection for Drupal 7 access bypass via missing parent entity access check | Medium | 0.2% | |
| CVE-2026-118584 | Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289 | Medium | 0.2% | |
| CVE-2026-118583 | Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288 | Medium | 0.2% | |
| CVE-2026-118582 | CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281 | High | 0.2% | |
| CVE-2026-118576 | Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286 | Medium | 0.2% | |
| CVE-2026-118575 | Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285 | Medium | 0.2% | |
| CVE-2026-118574 | S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279 | Medium | 0.1% | |
| CVE-2026-118573 | OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290 | Medium | 0.1% |