- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, drupal recorded 221 security vulnerabilities in the last 90 days across 152 products, including 14 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Webform had the most security vulnerabilities in the drupal ecosystem, with 20 vulnerabilities—approximately 9.05% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2020-13668Access bypass in Drupal Core 8/9CVE-2020-13688CVE-2020-13688CVE-2020-13663CVE-2020-13663CVE-2020-13667CVE-2020-13667CVE-2020-13666CVE-2020-13666| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2020-13668Access bypass in Drupal Core 8/9 | Exploitation statusNot confirmed | FixYes |
| Published02/11/2022 |
| SeverityUnknown |
CVE-2020-13688CVE-2020-13688 | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published06/11/2021 | SeverityUnknown |
|---|
CVE-2020-13663CVE-2020-13663 | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published06/11/2021 | SeverityUnknown |
|---|
CVE-2020-13667CVE-2020-13667 | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published05/17/2021 | SeverityUnknown |
|---|
CVE-2020-13666CVE-2020-13666 | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published05/05/2021 | SeverityUnknown |
|---|
CVE-2020-13665CVE-2020-13665 | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published05/05/2021 | SeverityUnknown |
|---|
CVE-2020-13664CVE-2020-13664 | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published05/05/2021 | SeverityUnknown |
|---|
CVE-2020-13662CVE-2020-13662 | Exploitation statusNot confirmed | FixNo | Affected productDrupal core | Published05/05/2021 | SeverityUnknown |
|---|
CVE-2020-13671CVE-2020-13671 | Exploitation statusKEV | FixNo | Affected productDrupal core | Published11/20/2020 | SeverityHigh |
|---|
CVE-2019-6342Drupal core - Critical - Access bypass - SA-CORE-2019-008 | Exploitation statusNot confirmed | FixNo | Affected productDrupal core | Published05/28/2020 | SeverityUnknown |
|---|
CVE-2011-2715CVE-2011-2715 | Exploitation statusNot confirmed | FixNo | Affected productData-module | Published01/14/2020 | SeverityUnknown |
|---|
CVE-2011-2714CVE-2011-2714 | Exploitation statusNot confirmed | FixNo | Affected productData-module | Published01/14/2020 | SeverityUnknown |
|---|
CVE-2010-2471CVE-2010-2471 | Exploitation statusNot confirmed | FixNo | Affected productdrupal6 | Published11/06/2019 | SeverityUnknown |
|---|
CVE-2019-11358CVE-2019-11358 | Exploitation statusActively exploited | FixYes | Affected productbackdrop | Published04/19/2019 | SeverityMedium |
|---|
CVE-2019-6341Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004 | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published03/26/2019 | SeverityUnknown |
|---|
CVE-2019-6340Drupal core - Highly critical - Remote Code Execution | Exploitation statusKEV | FixYes | Affected productDrupal core | Published02/21/2019 | SeverityHigh |
|---|
CVE-2019-6339PHAR stream wrapper Arbitrary PHP code execution | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published01/22/2019 | SeverityUnknown |
|---|
CVE-2019-6338third-party PEAR Archive_Tar library updates | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published01/22/2019 | SeverityUnknown |
|---|
CVE-2017-6923Access bypass in Drupal 8 views | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published01/22/2019 | SeverityUnknown |
|---|
CVE-2017-6922Files uploaded by anonymous users into a private file system can be accessed by other anonymous users | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published01/22/2019 | SeverityUnknown |
|---|
CVE-2017-6924REST API can bypass comment approval - Access Bypass - Moderately Critical | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published01/15/2019 | SeverityUnknown |
|---|
CVE-2017-6921File REST resource does not properly validate | Exploitation statusNot confirmed | FixYes | Affected productDrupal core | Published01/15/2019 | SeverityUnknown |
|---|
CVE-2018-7602Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 | Exploitation statusKEV | FixYes | Affected productcore | Published07/19/2018 | SeverityHigh |
|---|
CVE-2018-7600CVE-2018-7600 | Exploitation statusKEV | FixYes | Affected productDrupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 | Published03/29/2018 | SeverityCritical |
|---|
CVE-2017-6381CVE-2017-6381 | Exploitation statusNot confirmed | FixNo | Affected productDrupal core | Published03/16/2017 | SeverityUnknown |
|---|
CVE-2017-6379CVE-2017-6379 | Exploitation statusNot confirmed | FixNo | Affected productDrupal core | Published03/16/2017 | SeverityUnknown |
|---|
CVE-2017-6377CVE-2017-6377 | Exploitation statusNot confirmed | FixNo | Affected productDrupal core | Published03/16/2017 | SeverityUnknown |
|---|
CVE-2014-3704CVE-2014-3704 | Exploitation statusActively exploited | FixYes | Affected productdebian_linux | Published10/16/2014 | SeverityHigh |
|---|
478 Results | Page 10 of 10