Drupal — security advisories

31 advisories6 exploitedlatest 2026-07-09⚡ RSS feed

Tracked Drupal products:

Drupal Core Core Drupal Extensions Location Selector Drupal Modules

⚡ Watch Drupal

Get an email when a new Drupal advisory drops — max one per day, one-click unsubscribe.

[NEW] [high] Drupal Modules: Multiple vulnerabilities

highCVE-2026-15079 CVE-2026-15080 CVE-2026-15081 CVE-2026-15082cert-bund2026-07-09

Drupal security advisory (AV26-676)

criticalcccs2026-07-08

[NEW] [medium] Drupal Extensions: Multiple vulnerabilities

mediumCVE-2026-58587 CVE-2026-58588 CVE-2026-58589 CVE-2026-58590cert-bund2026-07-02

Drupal security advisory (AV26-631)

criticalcccs2026-06-25

Drupal Multiple Vulnerabilities

unknownCVE-2026-55803 CVE-2026-55804 CVE-2026-55806 CVE-2026-55807hkcert2026-06-23

Drupal security advisory (AV26-615)

criticalcccs2026-06-18

Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

criticalCVE-2026-55808drupal2026-06-17

Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

criticalCVE-2026-55807drupal2026-06-17

Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

criticalCVE-2026-55806drupal2026-06-17

Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

criticalCVE-2026-55804drupal2026-06-17

Drupal core - Critical - PHP object injection - SA-CORE-2026-005

criticalCVE-2026-55803drupal2026-06-17

CVE-2026-9082: Drupal Core SQL Injection Vulnerability

criticalexploitedCVE-2026-9082cisa-kev2026-05-22

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

criticalexploitedCVE-2026-9082drupal2026-05-20

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003

criticalCVE-2026-6367drupal2026-04-15

Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

criticalCVE-2026-6366drupal2026-04-15

Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001

criticalCVE-2026-6365drupal2026-04-15

Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

criticalCVE-2025-13083drupal2025-11-12

Drupal core - Moderately critical - Defacement - SA-CORE-2025-007

criticalCVE-2025-13082drupal2025-11-12

Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006

criticalCVE-2025-13081drupal2025-11-12

Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005

criticalCVE-2025-13080drupal2025-11-12

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

criticalCVE-2025-31675drupal2025-03-19

Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

criticalCVE-2025-31674drupal2025-02-19

Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

criticalCVE-2025-31673drupal2025-02-19

Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

criticalCVE-2025-3057drupal2025-02-19

Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008

criticalCVE-2024-55638drupal2024-11-20

Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007

criticalCVE-2024-55637drupal2024-11-20

Drupal core - Less critical - Gadget chain - SA-CORE-2024-006

criticalCVE-2024-55636drupal2024-11-20

CVE-2018-7602: Drupal Core Remote Code Execution Vulnerability

criticalexploitedCVE-2018-7602cisa-kev2022-04-13

CVE-2019-6340: Drupal Core Remote Code Execution Vulnerability

criticalexploitedCVE-2019-6340cisa-kev2022-03-25

CVE-2020-13671: Drupal core Un-restricted Upload of File

criticalexploitedCVE-2020-13671cisa-kev2022-01-18

CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability

criticalexploitedCVE-2018-7600cisa-kev2021-11-03