Exploited vulnerabilities
Drupal
5 Drupal vulnerabilities in the CISA KEV catalogue: those for which the US cybersecurity agency has evidence of exploitation in real attacks.
In the catalogue5
Last 12 months1
In ransomware campaigns2
Last addition22 May 2026
The vulnerabilities5
- 22 May 2026CVE-2026-9082CoreDrupal Core SQL Injection Vulnerability
- 13 April 2022CVE-2018-7602CoreDrupal Core Remote Code Execution VulnerabilityRansomware
- 25 March 2022CVE-2019-6340CoreDrupal Core Remote Code Execution Vulnerability
- 18 January 2022CVE-2020-13671Drupal coreDrupal core Un-restricted Upload of File
- 3 November 2021CVE-2018-7600Drupal CoreDrupal Core Remote Code Execution VulnerabilityRansomware
Data: CISA Known Exploited Vulnerabilities (KEV) catalogue, last addition on 4 November 2026.
The catalogue lists only vulnerabilities with evidence of exploitation, not all of the vendor's vulnerabilities.
Alerts only on the products you use
With My Defence you receive alerts and briefings only on the products you use, Drupal included.