Drupal: exploited vulnerabilities

5exploited vulnerabilities
2used by ransomware
May 22, 2026latest one added

Core 3
Drupal core 1
Drupal Core 1

Added	Vulnerability	Product	Severity	Attack chance
May 22, 2026	SQL InjectionCVE-2026-9082	Core	Critical 9.8	89%
Apr 13, 2022	Remote Code ExecutionCVE-2018-7602used by ransomware	Core	High 8.1	99.2%
Mar 25, 2022	Remote Code ExecutionCVE-2019-6340	Core	High 8.1	92%
Jan 18, 2022	core Un-restricted Upload of FileCVE-2020-13671	Drupal core	High 8.8	36%
Nov 3, 2021	Core Remote Code ExecutionCVE-2018-7600used by ransomware	Drupal Core	Critical 9.8	>99.9%

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.