Drupal
5 Drupal flaws are on CISA's list of vulnerabilities attackers have used, 1 of them added in 2026. CISA says 2 are known to be used by ransomware. The latest was added May 22, 2026.
5on CISA's list, all time
1added in 2026
0in the last 90 days
2used by ransomware
1zero-days, all time
Exploited flaws added each year
Most-hit products
| Product | Exploited flaws | Most recent |
|---|---|---|
| Core | 3 | May 22, 2026 |
| Drupal core | 1 | Jan 18, 2022 |
| Drupal Core | 1 | Nov 3, 2021 |
Latest Drupal flaws
- CoreDrupal Core SQL Injection Vulnerability
- CoreDrupal Core Remote Code Execution Vulnerability
- CoreDrupal Core Remote Code Execution Vulnerability
- Drupal coreDrupal core Un-restricted Upload of File
- Drupal CoreDrupal Core Remote Code Execution Vulnerability
Counts come from CISA's Known Exploited Vulnerabilities catalog, which lists flaws with reliable evidence of real attacks. A higher count often reflects how widely a vendor's products are used and targeted, not only how secure they are.