Drupal security vulnerabilities
Drupal core and contributed module security records from public advisories.
Built for CMS administrators.
110 public records · 23 security-fix timeline events.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 0
- Medium 0
- Low 0
2026-07-210 issues2026-10-18
Known exploited
View all known exploited- Critical9.8Drupal Core SQL Injection VulnerabilityPatch nowKEVEPSS 15.70%May 20, 2026
- High7.8PEAR Archive_Tar Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 84.55%Nov 19, 2020
- High7.5PEAR Archive_Tar Improper Link Resolution VulnerabilityPatch nowKEVEPSS 70.59%Jan 18, 2021
- High8.8Drupal core Un-restricted Upload of FilePatch nowKEVEPSS 35.35%Nov 20, 2020
- Medium6.1JQuery Cross-Site Scripting (XSS) VulnerabilityPatch nowKEVEPSS 84.89%Apr 29, 2020
- High8.1Drupal Core Remote Code Execution VulnerabilityPatch nowKEVEPSS 92.02%Feb 21, 2019
- Critical9.8Drupal Core Remote Code Execution VulnerabilityPatch nowKEVEPSS 99.17%Jul 19, 2018
- Critical9.8Drupal Core Remote Code Execution VulnerabilityPatch nowKEVEPSS 99.99%Mar 29, 2018
Recently published
Browse catalog- Medium5.1An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users.Check if you run itEPSS 0.39%May 28, 2026
- High7.4Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation.Check if you run itEPSS 0.34%May 28, 2026
- Medium5.1Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text.Check if you run itEPSS 0.32%May 21, 2026
- Medium5.1In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline.Check if you run itEPSS 0.26%May 21, 2026
- Critical9.8Drupal Core SQL Injection VulnerabilityPatch nowKEVEPSS 15.70%May 20, 2026
- Critical9.8Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing.Check if you run itEPSS 0.49%May 19, 2026
- Medium5.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS).Check if you run itEPSS 0.23%May 19, 2026
- Medium6.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS).Check if you run itEPSS 0.25%May 19, 2026
- Medium6.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS).Check if you run itEPSS 0.25%May 19, 2026
- Medium6.1Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003Check if you run itEPSS 0.25%Apr 15, 2026