drupal has 78 CVEs on record between 2018 and 2026. Disclosure cadence is accelerating: 76 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 72. The median CVSS is 4.8 (medium), with 3 rated critical. 3% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-79 (18) and CWE-862 (12). Most affected products: Webform (20), SAML SSO - Service Provider (11), Gammu SMS Daemon (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 3% vs 1% corpus
- Median CVSS
- 4.8
- Publish → KEV
- —(2)
- Last 90 days
- 76 prev 1
Weakness classes
Products
- Webform 20
- SAML SSO - Service Provider 11
- Gammu SMS Daemon 3
- AI (Artificial Intelligence) 2
- Cloud 2
- Email Verification / SMS Verification / OTP Verification 2
Worst active — by depth score
CVE-2018-7602Critical· 9.8A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x100CVE-2026-9082Critical· 9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 1…97CVE-2026-96355Critical· 9.1Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-17550CVE-2026-96365High· 7.5Webform - Less critical - Denial of service - SA-CONTRIB-2026-17041CVE-2026-76782High· 7.3Vulnerability in Drupal Screenshot40
drupal vulnerabilities
CVEs affecting drupal, newest first. Open any entry for full detail, references, and exploit status.
78 CVEsRSS
CVE-2026-84916Low· 3.7Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126
Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.
CVE-2026-84924Medium· 5.4Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verif…
CVE-2026-84917Medium· 6.5Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127
Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.
CVE-2026-84914Medium· 5.3Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122
Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.
CVE-2026-81163Medium· 5.4Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.
CVE-2026-16648Low· 3.8Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128
Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.
CVE-2026-84923Medium· 6.5Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verifi…
CVE-2026-84915Medium· 4.6Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.
CVE-2026-84913Medium· 4.6AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121
Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.
CVE-2026-84912Medium· 4.6AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.
CVE-2026-84911Low· 3.1AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, …
CVE-2026-84910Medium· 4.2Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118
Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.
CVE-2026-76782High· 7.3Vulnerability in Drupal Screenshot
Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.
CVE-2026-76757Medium· 5.9Vulnerability in Drupal Gammu SMS Daemon
Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.
CVE-2026-76755Medium· 5.9Vulnerability in Drupal Gammu SMS Daemon
Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.
CVE-2026-76756Medium· 5.9Vulnerability in Drupal Gammu SMS Daemon
Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.
CVE-2026-9082Critical· 9.8CISA KEVPoCImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 1…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 1…
CVE-2018-7602Critical· 9.8CISA KEVPoCA remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This …