By year
02
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Drupal flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-9082 Drupal Core SQL InjectionExploited since May 22, 2026 · CVSS 9.8
- CVE-2018-7602 Drupal Core Remote Code ExecutionExploited since Apr 13, 2022 · ransomware · CVSS 9.8
- CVE-2019-6340 Drupal Core Remote Code ExecutionExploited since Mar 25, 2022 · CVSS 8.1
- CVE-2020-13671 Drupal core Un-restricted Upload of FileExploited since Jan 18, 2022 · CVSS 8.8
- CVE-2018-7600 Drupal Core Remote Code ExecutionExploited since Nov 3, 2021 · ransomware · CVSS 9.8
Latest high and critical flaws
- CVE-2026-9082 Drupal Core SQL InjectionExploited · Critical 9.8 · May 20, 2026
- CVE-2025-8995 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects AuthenticatCritical 9.8 · Aug 15, 2025
- CVE-2025-8675 Server-Side Request Forgery (SSRF) vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.This issue affects AI SEO Link Advisor: from 0High 8.8 · Aug 15, 2025
- CVE-2025-8092 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site ScriptHigh 7.6 · Aug 15, 2025
- CVE-2025-7717 Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 beforHigh 7.5 · Jul 21, 2025
- CVE-2025-7393 Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 beforeCritical 9.8 · Jul 21, 2025
- CVE-2025-48921 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.1High 8.8 · Jun 26, 2025
- CVE-2025-48920 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal etracker allows Cross-Site Scripting (XSS).This issHigh 7.3 · Jun 13, 2025
- CVE-2025-48918 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).ThisHigh 8.8 · Jun 13, 2025
- CVE-2025-48915 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site ScriptHigh 8.6 · Jun 13, 2025
- CVE-2025-48914 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site ScriptHigh 8.6 · Jun 13, 2025
- CVE-2025-48447 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site Scripting (XSS).ThisHigh 7.1 · Jun 11, 2025
- CVE-2025-48446 Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0High 8.8 · Jun 11, 2025
- CVE-2025-48445 Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0High 8.8 · Jun 11, 2025
- CVE-2025-4416 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track: fHigh 7.5 · May 21, 2025
- CVE-2025-47710 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affectsHigh 7.4 · May 14, 2025
- CVE-2025-47708 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - High 8.8 · May 14, 2025
- CVE-2025-47707 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affectsHigh 7.5 · May 14, 2025
- CVE-2025-47701 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site Request Forgery.This issue affects Restrict route by IP: from 0High 8.8 · May 14, 2025
- CVE-2025-3904 Vulnerability in Drupal Sportsleague.This issue affects Sportsleague: *.*.High 7.3 · Apr 23, 2025
- CVE-2025-31694 Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): froHigh 8.1 · Mar 31, 2025
- CVE-2025-31691 Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.Critical 9.8 · Mar 31, 2025
- CVE-2025-31690 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.High 8.8 · Mar 31, 2025
- CVE-2025-31689 Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data PHigh 8.1 · Mar 31, 2025
- CVE-2025-31686 Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 beforeHigh 8.1 · Mar 31, 2025
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.