Drupal
5 CVEs in CISA KEV — 2 with confirmed ransomware use
Products
| CVE | Product | CVSS | EPSS | Added | Due | Flags | Description |
|---|---|---|---|---|---|---|---|
CVE-2026-9082 |
Core | — | 0.8938 | 2026-05-22 | 2026-05-27 | Drupal Core contains a SQL injection vulnerability that could allow for privileg | |
CVE-2018-7602 |
Core | — | — | 2022-04-13 | 2022-05-04 | RW | A remote code execution vulnerability exists within multiple subsystems of Drupa |
CVE-2019-6340 |
Core | — | — | 2022-03-25 | 2022-04-15 | In Drupal Core, some field types do not properly sanitize data from non-form sou | |
CVE-2020-13671 |
Drupal core | — | — | 2022-01-18 | 2022-07-18 | Improper sanitization in the extension file names is present in Drupal core. | |
CVE-2018-7600 |
Drupal Core | — | — | 2021-11-03 | 2022-05-03 | RW | Drupal Core contains a remote code execution vulnerability that could allow an a |