Drupal vulnerabilities - every known CVE across core and contributed modules

Drupal security

Enterprise CMS with a strong security process

Drupal is widely used by large government, media, and enterprise websites. The Drupal Security Team reviews every reported vulnerability and issues formal advisories using SA-CORE identifiers for core issues and SA-CONTRIB identifiers for contributed modules. They coordinate embargo windows so administrators have time to patch before public disclosure. Each advisory includes a risk score, affected versions, and remediation steps.

Drupal has had some of the highest-impact CMS vulnerabilities ever published. Drupalgeddon (SA-CORE-2014-005 / CVE-2014-3704) was a SQL injection in the database abstraction layer that was exploited at scale within hours of disclosure. CERT advised that any unpatched site should be considered compromised. CVE-2018-7600 followed the same pattern. These incidents shaped Drupal's current focus on fast patching and automated update notifications.

Most Drupal CVEs affect contributed modules, not core. Common issues include SQL injection in custom entity queries, access bypass in content permission checks, remote code execution through unsafe file handling, cross-site scripting in display formatters, and insecure direct object references in REST API endpoints.

CVSS and triage

Drupal vulnerability severity in context

CVSS scores in this database come from NVD and reflect the worst-case severity under ideal attack conditions. The Drupal Security Team also publishes its own risk scores, which factor in exploitability history and compensating controls. For high-traffic or sensitive Drupal sites, check the official SA advisory alongside the CVSS score shown here.

Drupal core patches come through the admin update interface and Composer. Contributed module patches require updating each module individually. After updating, run drush updatedb to apply any pending database updates that come with the security release.