CVE security advisories and vulnerability history for Drupal core by Drupal.
57
Total CVEs
Published
3
In CISA KEV
Exploited in the wild
4
Public exploits
PoC or exploit code
6.3
Avg CVSS
2017–2026
Last updated
Overview
Drupal core has 57 published CVE records since 2017, of which 3 are in CISA's Known Exploited Vulnerabilities catalog and 4 have a known public exploit. The average CVSS base score across scored CVEs is 6.3.
Severity and exploitation
How the CVSS severity of Drupal core's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.
Critical6
High13
Medium32
Low6
In CISA’s Known Exploited Vulnerabilities catalog
3
3 of Drupal core's CVEs are confirmed exploited in the wild.
Public exploits
4
4 of Drupal core's CVEs have a known public exploit available.
Affected versions and CVEs
Browse every Drupal core version named in a CVE, then pick one to see only the CVEs that affect it.
Specific versions
7 versions prior to 7.741 CVE
8.8 versions prior to 8.8.111 CVE
8.9 versions prior to 8.9.91 CVE
9.0 versions prior to 9.0.81 CVE
Version ranges
0.0.0 <= v < 11.0.*7 CVEs
0.0.0 <= v < 11.1.*7 CVEs
0.0.0 <= v < 10.5.125 CVEs
10.3.0 <= v < 10.3.95 CVEs
10.6.0 <= v < 10.6.115 CVEs
11.2.0 <= v < 11.2.145 CVEs
Common weakness types
The CWE weakness categories most often found in Drupal core CVEs. Follow any weakness for its full explanation.
Common questions about Drupal core vulnerabilities.
How many CVEs does Drupal Drupal core have?
Drupal Drupal core has 57 published CVE records since 2017.
How many Drupal Drupal core CVEs are in CISA KEV?
Yes — 3 of Drupal Drupal core's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for Drupal Drupal core vulnerabilities?
Yes — 4 of Drupal Drupal core's CVEs have a known public exploit.
Which versions of Drupal Drupal core are affected?
137 distinct Drupal Drupal core versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Drupal Drupal core CVEs?
Drupal Drupal core's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-502 (Deserialization of Untrusted Data).
How many critical Drupal Drupal core vulnerabilities are there?
Drupal Drupal core has 6 critical and 13 high-severity CVEs.
What is the average severity of Drupal Drupal core CVEs?
The average CVSS base score across Drupal Drupal core's scored CVEs is 6.3.
