{"meta":{"title":"KEV entries: Drupal","description":"All KEV entries for vendor Drupal.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":5,"vendor":"Drupal","entries":5,"shareOfCatalogPercent":0.3,"ransomwareKnown":2,"firstDateAdded":"2021-11-03","latestDateAdded":"2026-05-22","rank":43},"data":[{"cveID":"CVE-2026-9082","vendorProject":"Drupal","product":"Core","vulnerabilityName":"Drupal Core SQL Injection Vulnerability","dateAdded":"2026-05-22","dueDate":"2026-05-27","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-89"],"shortDescription":"Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.drupal.org/sa-core-2026-004 ; https://nvd.nist.gov/vuln/detail/CVE-2026-9082","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-9082"},{"cveID":"CVE-2018-7602","vendorProject":"Drupal","product":"Core","vulnerabilityName":"Drupal Core Remote Code Execution Vulnerability","dateAdded":"2022-04-13","dueDate":"2022-05-04","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-7602","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-7602"},{"cveID":"CVE-2019-6340","vendorProject":"Drupal","product":"Core","vulnerabilityName":"Drupal Core Remote Code Execution Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-502"],"shortDescription":"In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-6340","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-6340"},{"cveID":"CVE-2020-13671","vendorProject":"Drupal","product":"Drupal core","vulnerabilityName":"Drupal core Un-restricted Upload of File","dateAdded":"2022-01-18","dueDate":"2022-07-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-434"],"shortDescription":"Improper sanitization in the extension file names is present in Drupal core.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-13671","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-13671"},{"cveID":"CVE-2018-7600","vendorProject":"Drupal","product":"Drupal Core","vulnerabilityName":"Drupal Core Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-7600","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2018-7600"}]}