Vendor
Drupal
As of , 5 Drupal vulnerabilities are on CISA's list of exploited vulnerabilities, 2 of them used in ransomware campaigns; 1 was added in 2026. Patch first: CVE-2019-6340.
Patch first
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2019-6340Remote Code Execution | Drupal Core | Patch this weekMetasploit module; EPSS 0.92; verified Exploit-DB entry | 0.92 | ||
| 2 | CVE-2018-7600Remote Code Execution | Drupal Drupal Core | Patch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry | 0.99 | ||
| 3 | CVE-2026-9082SQL Injection | Drupal Core | Patch this weekMetasploit module | 0.16 | ||
| 4 | CVE-2018-7602Remote Code Execution | Drupal Core | Patch this weekRansomware use; EPSS 0.99; verified Exploit-DB entry | 0.99 | ||
| 5 | CVE-2020-13671Un-restricted Upload of File | Drupal Drupal core | Patch soon | 0.35 |
Products
- Core3 entries
- Drupal core2 entries
Added each year
Show the numbers
| Period | entries added |
|---|---|
| 2021 | 1 |
| 2022 | 3 |
| 2023 | none |
| 2024 | none |
| 2025 | none |
| 2026 | 1 |