Drupal
907 CVEs across 105 months on the top 200 list since Mar 2005. Peak rank #4 in Jul 2008. 4 of them are now in CISA KEV.
Drupal CVEs per month since Mar 2005
Dec 2021: below the top 200 that month, 2 or fewer CVEsJan 2022: below the top 200 that month, 2 or fewer CVEsFeb 2022: 11 CVEs · 1 critical · 0 now in CISA KEV · rank #61 · mostly Core, Drupal, Entity EmbedMar 2022: 3 CVEs · 0 critical · 0 now in CISA KEV · rank #185 · mostly DrupalApr 2022: below the top 200 that month, 3 or fewer CVEsMay 2022: below the top 200 that month, 3 or fewer CVEsJun 2022: 3 CVEs · 1 critical · 0 now in CISA KEV · rank #191 · mostly Drupal, Saml Sp 2.0 Single Sign OnJul 2022: below the top 200 that month, 3 or fewer CVEsAug 2022: below the top 200 that month, 3 or fewer CVEsSep 2022: below the top 200 that month, 3 or fewer CVEsOct 2022: below the top 200 that month, 2 or fewer CVEsNov 2022: below the top 200 that month, 3 or fewer CVEsDec 2022: below the top 200 that month, 3 or fewer CVEsJan 2023: below the top 200 that month, 3 or fewer CVEsFeb 2023: below the top 200 that month, 3 or fewer CVEsMar 2023: no snapshot, the run for this month failedApr 2023: 7 CVEs · 0 critical · 0 now in CISA KEV · rank #93 · mostly Core, DrupalMay 2023: below the top 200 that month, 3 or fewer CVEsJun 2023: below the top 200 that month, 4 or fewer CVEsJul 2023: below the top 200 that month, 3 or fewer CVEsAug 2023: below the top 200 that month, 4 or fewer CVEsSep 2023: below the top 200 that month, 3 or fewer CVEsOct 2023: below the top 200 that month, 4 or fewer CVEsNov 2023: below the top 200 that month, 4 or fewer CVEsDec 2023: below the top 200 that month, 4 or fewer CVEsJan 2024: below the top 200 that month, 4 or fewer CVEsFeb 2024: below the top 200 that month, 4 or fewer CVEsMar 2024: below the top 200 that month, 4 or fewer CVEsApr 2024: below the top 200 that month, 4 or fewer CVEsMay 2024: below the top 200 that month, 5 or fewer CVEsJun 2024: below the top 200 that month, 4 or fewer CVEsJul 2024: below the top 200 that month, 4 or fewer CVEsAug 2024: below the top 200 that month, 4 or fewer CVEsSep 2024: below the top 200 that month, 3 or fewer CVEsOct 2024: below the top 200 that month, 4 or fewer CVEsNov 2024: below the top 200 that month, 4 or fewer CVEsDec 2024: 8 CVEs · 3 critical · 0 now in CISA KEV · rank #82 · mostly Drupal Core, DrupalJan 2025: 74 CVEs · 12 critical · 0 now in CISA KEV · rank #15 · mostly Open Social, Node Access Rebuild Progressive, Two-factor Authentication (Tfa)Feb 2025: below the top 200 that month, 3 or fewer CVEsMar 2025: 30 CVEs · 3 critical · 0 now in CISA KEV · rank #31 · mostly Drupal, AI (Artificial Intelligence), Drupal CoreApr 2025: 18 CVEs · 0 critical · 0 now in CISA KEV · rank #48 · mostly Sportsleague, Stage File Proxy, Ueditor - 百度编辑器May 2025: 16 CVEs · 0 critical · 0 now in CISA KEV · rank #51 · mostly Enterprise Mfa - Tfa For Drupal, One Time Password, Single Content SyncJun 2025: 21 CVEs · 0 critical · 0 now in CISA KEV · rank #40 · mostly Simple Klaro, Quick Node Block, Cookies Consent ManagementJul 2025: 7 CVEs · 1 critical · 0 now in CISA KEV · rank #131 · mostly Block Attributes, Config Pages Viewer, Cookies AddonsAug 2025: 6 CVEs · 1 critical · 0 now in CISA KEV · rank #135 · mostly AI Seo Link Advisor, Authenticator Login, Config PagesSep 2025: below the top 200 that month, 4 or fewer CVEsOct 2025: 17 CVEs · 0 critical · 0 now in CISA KEV · rank #63 · mostly Facets, Civictheme Design System, API Key ManagerNov 2025: 7 CVEs · 0 critical · 0 now in CISA KEV · rank #106 · mostly Drupal, Drupal Core, Email TfaDec 2025: below the top 200 that month, 5 or fewer CVEsJan 2026: 14 CVEs · 0 critical · 0 now in CISA KEV · rank #68 · mostly Acquia Content Hub, AI (Artificial Intelligence), Ckeditor 5 Premium FeaturesFeb 2026: 7 CVEs · 0 critical · 0 now in CISA KEV · rank #146 · mostly At Internet Piano Analytics, At Internet Smarttag, Central Authentication System (Cas) ServerMar 2026: 25 CVEs · 0 critical · 0 now in CISA KEV · rank #46 · mostly Openid Connect / Oauth Client, File Access Fix (Deprecated), Anti-spam By CleantalkApr 2026: below the top 200 that month, 6 or fewer CVEsMay 2026: 14 CVEs · 1 critical · 1 now in CISA KEV · rank #82 · mostly Drupal Core, Drupal, Saml Sso - Service ProviderJun 2026: below the top 200 that month, 7 or fewer CVEsJul 2026: 46 CVEs · 5 critical · 0 now in CISA KEV · rank #17 · mostly Drupal, Drupal Core, Drupal CanvasAug 2026: 17 CVEs · 4 critical · 0 now in CISA KEV · rank #90 · mostly Drupal Core, Search API Autocomplete, Token Content AccessSep 2026: 26 CVEs · 1 critical · 0 now in CISA KEV · rank #58 · mostly Gammu Sms Daemon, Screenshot, Slick CarouselOct 2026: 178 CVEs · 2 critical · 0 now in CISA KEV · rank #11 · mostly Webform, Saml Sso - Service Provider, AI (Artificial Intelligence)Nov 2026: none that month (the list had room for every one)
In the lens
The products that kept showing up in Drupal's monthly top three from Dec 2021 to Nov 2026. Move the lens and the list follows.
Year by year
Each year's months on the top 200 list. Pick a year to read it in the lens.
The record
- Peak rank
- #4 in Jul 2008
- Busiest month
- Oct 2026, 178 CVEs
- Months with a KEV entry
- 3 of 105 on the list
- On the top 200 list
- 105 of 242 monthly snapshots