1,146 CVEs
8 in CISA KEV
Drupal Vulnerabilities
CVE security advisories and vulnerability history for Drupal.
1,146
Total CVEs
Published
8
In CISA KEV
Exploited in the wild
43
Public exploits
PoC or exploit code
5.4
Avg CVSS
2005–2026
Overview
Drupal has 1,146 published CVE records since 2005, of which 8 are in CISA's Known Exploited Vulnerabilities catalog and 43 have a known public exploit. The average CVSS base score across scored CVEs is 5.4.
This page aggregates every publicly disclosed vulnerability (CVE) affecting Drupal products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.