Drupal

This hub aggregates every CVE we track for Drupal, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Drupal.

• CVE-2026-55808Drupal core - Moderately critical - Improper validation - SA-CORE-2026-0095.4Jul 10, 2026
• CVE-2026-55807Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-0083.1Jul 10, 2026
• CVE-2026-55804Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-0065.9Jul 10, 2026
• CVE-2026-55806Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-0075.9Jul 10, 2026
• CVE-2026-55803Drupal core - Critical - PHP object injection - SA-CORE-2026-0055.9Jul 10, 2026
• CVE-2026-9082Drupal core - Highly critical - SQL injection - SA-CORE-2026-004KEV9.8May 20, 2026
• CVE-2026-6367Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-0036.1May 19, 2026
• CVE-2026-6366Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-0026.6May 19, 2026
• CVE-2026-6365Drupal core - Critical - Cross-site scripting - SA-CORE-2026-0016.1May 19, 2026
• CVE-2025-12848XSS vulnerability when rendering filename in Webform Multiform6.1Nov 26, 2025
• CVE-2025-13083Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-0083.7Nov 18, 2025
• CVE-2025-13082Drupal core - Moderately critical - Defacement - SA-CORE-2025-0074.3Nov 18, 2025
• CVE-2025-13081Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-0065.9Nov 18, 2025
• CVE-2025-13080Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-0055.3Nov 18, 2025
• CVE-2025-31695Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-0246.1Mar 31, 2025