Drupal core vulnerabilities

9 known vulnerabilities in Drupal core from Drupal. 9 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Drupal core: Use of Externally-Controlled Input to Select Classes or Code

  CVE-2026-108097Oct 30, 2026Drupal

  Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10,

• 9.8 Critical severity

  Drupal Core SQL Injection Exploited

  CVE-2026-9082May 20, 2026DrupalEPSS 89.4%

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, fro

• 7.5 High severity

  Drupal core: Improper Control of Dynamically-Managed Code Resources

  CVE-2025-31674Mar 31, 2025Drupal

  Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11

• 9.8 Critical severity

  Drupal Core: Deserialization of Untrusted Data

  CVE-2024-55638Dec 10, 2024Drupal

  Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core contains a chain of methods that is exploitable when

• 9.8 Critical severity

  Drupal Core: Deserialization of Untrusted Data

  CVE-2024-55637Dec 10, 2024Drupal

  Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable

• 9.8 Critical severity

  Drupal Core: Deserialization of Untrusted Data

  CVE-2024-55636Dec 10, 2024Drupal

  Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable

• 8.1 High severity

  Drupal Core: Improper Handling of Case Sensitivity

  CVE-2024-55634Dec 10, 2024Drupal

  A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

• 8.8 High severity

  Drupal core Un-restricted Upload of File Exploited

  CVE-2020-13671Nov 20, 2020DrupalEPSS 32.6%

  Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal

• 8.1 High severity

  Drupal Core Remote Code Execution Exploited

  CVE-2019-6340Feb 21, 2019DrupalEPSS 92%

  Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions i