117 CVEs
6 in CISA KEV
composer
Drupal drupal/core Vulnerabilities
CVE security advisories and vulnerability history for drupal/core by Drupal.
117
Total CVEs
Published
6
In CISA KEV
Exploited in the wild
CVE security advisories and vulnerability history for drupal/core by Drupal.
Last updated
Drupal drupal/core has 117 published CVE records since 2011, of which 6 are in CISA's Known Exploited Vulnerabilities catalog and 8 have a known public exploit. The average CVSS base score across scored CVEs is 6.7.
This page aggregates every publicly disclosed vulnerability (CVE) affecting Drupal drupal/core, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.
How the CVSS severity of Drupal drupal/core's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.
In CISA’s Known Exploited Vulnerabilities catalog
6
6 of Drupal drupal/core's CVEs are confirmed exploited in the wild.
Public exploits
8
8 of Drupal drupal/core's CVEs have a known public exploit available.
Browse every Drupal drupal/core version named in a CVE, then pick one to see only the CVEs that affect it.
The CWE weakness categories most often found in Drupal drupal/core CVEs. Follow any weakness for its full explanation.
How many Drupal drupal/core CVEs were published each year.
Browse vulnerabilities for other products by Drupal.
Common questions about Drupal drupal/core vulnerabilities.
Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.
Monitor new Drupal drupal/core vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.
117 CVEs
Added to CISA KEV 2026-05-22
Showing 30 of 117