Drupal has 184 CVEs on record between 2018 and 2026. Disclosure cadence is accelerating: 182 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 178. The median CVSS is 4.8 (medium), with 4 rated critical. 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-79 (45) and CWE-863 (35). Most affected products: Webform (20), SAML SSO - Service Provider (11), AI (Artificial Intelligence) (10).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 4.8
- Publish → KEV
- —(2)
- Last 90 days
- 182 prev 1
Weakness classes
Products
- Webform 20
- SAML SSO - Service Provider 11
- AI (Artificial Intelligence) 10
- Commerce Core 6
- Commerce Stripe 3
- Drupal core 3
Worst active — by depth score
CVE-2018-7602Critical· 9.8A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x100CVE-2026-9082Critical· 9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 1…97CVE-2026-107249Critical· 9.8Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-19254CVE-2026-96355Critical· 9.1Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-17550CVE-2026-110176High· 8.7File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers48
Drupal vulnerabilities
CVEs affecting Drupal, newest first. Open any entry for full detail, references, and exploit status.
184 CVEsRSS
CVE-2026-76755Medium· 5.9Vulnerability in Drupal Gammu SMS Daemon
Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.
CVE-2026-76756Medium· 5.9Vulnerability in Drupal Gammu SMS Daemon
Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.
CVE-2026-9082Critical· 9.8CISA KEVPoCImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 1…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 1…
CVE-2018-7602Critical· 9.8CISA KEVPoCA remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This …