CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Drupal Core SQL Injection Vulnerability (CVE-2026-9082) Critical Security Advisory
[Affected Scope] Drupal core versions 8.9.0 to < 10.4.10, 10.5.0 to < 10.5.10, 10.6.0 to < 10.6.9, 11.0.0 to < 11.1.10, 11.2.0 to < 11.2.12, and 11.3.0 to < 11.3.10
[Impact] Unauthenticated remote attackers can inject malicious SQL queries to extract sensitive database information, hijack administrator sessions, or potentially achieve Remote Code Execution (RCE).
[Mitigation] Immediately upgrade Drupal core to the respective patched versions (10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10, or later).
Drupal Core Remote Code Execution (RCE) Vulnerability Advisory (CVE-2019-6340)
[Affected Scope] Drupal 8.5.x before 8.5.11, Drupal 8.6.x before 8.6.10, and Drupal 7 environments utilizing web services modules such as RESTful Web Services or JSON:API
[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server by sending specially crafted REST API requests, potentially leading to full system compromise
[Mitigation] Immediately upgrade Drupal Core to the latest secure versions (8.5.11, 8.6.10, or later) or disable vulnerable REST/JSON:API modules as a temporary workaround
Drupal Core Remote Code Execution (RCE) Vulnerability (CVE-2018-7602, Drupalgeddon 2 Sequel)
[Affected Scope] Drupal Core 7.x and 8.x versions (prior to 7.59, 8.5.3, and 8.4.8)
[Impact] Unauthenticated remote attackers can exploit multiple attack vectors to execute arbitrary code and fully compromise the target Drupal site
[Mitigation] Immediately upgrade Drupal Core to the patched versions (7.59, 8.5.3, 8.4.8, or higher)