Drupal

A track record, not a security rating. Every flaw in Drupal's products that CISA has confirmed was exploited, since its list began. Bigger vendors have more products and more attackers looking, so compare patterns, not totals.

Exploited flaws: 5in 3 products
Added to CISA's list in 2026: 10 in 2025
Used by ransomware: 2of 5, says CISA
Disclosure to CISA's list: Not yet4 of 4 flaws dated so far; filling in daily

Exploited flaws by the year they were disclosed

The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.

Hover or tab through a year for its count.

Show as a table

Year disclosed	Exploited flaws
2018	2
2019	1
2020	1
2021	0
2022	0
2023	0
2024	0
2025	0
2026	1

Products exploited more than once

Product	Flaws	First listed	Latest
Core	3	2022-03-25	2026-05-22

Latest on CISA's list

Drupal Core SQL Injection VulnerabilityCVE-2026-9082 · added 2026-05-22
Drupal Core Remote Code Execution VulnerabilityCVE-2018-7602 · added 2022-04-13 · used by ransomware
Drupal Core Remote Code Execution VulnerabilityCVE-2019-6340 · added 2022-03-25
Drupal core Un-restricted Upload of FileCVE-2020-13671 · added 2022-01-18
Drupal Core Remote Code Execution VulnerabilityCVE-2018-7600 · added 2021-11-03 · used by ransomware

In the news

Drupal patches critical RCE flaws, warns exploits may emerge soonBleepingComputer · 12d ago

From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.