{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Drupal vulnerabilities","home_page_url":"https://patchfirst.co/vendor/drupal/","feed_url":"https://patchfirst.co/feed/vendor/drupal.json","description":"New and newly exploited Drupal CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-118539","url":"https://patchfirst.co/cve/CVE-2026-118539/","title":"CVE-2026-118539: Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing","content_text":"Drupal · Commerce Core. Not in CISA KEV. EPSS 0.2% (higher than 12.8% of CVEs). CVSS 6.5 MEDIUM. Priority 52.8 of 100.","summary":"Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing","date_published":"2026-10-30T00:00:00.000Z","date_modified":"2026-10-31T04:18:17.000Z","tags":[],"_patchfirst":{"reason":"published","priority":52.8,"kev":null,"epss":{"score":0.00222,"percentile":0.12836},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Drupal","product":"Commerce Core","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-107249","url":"https://patchfirst.co/cve/CVE-2026-107249/","title":"CVE-2026-107249: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX…","content_text":"Drupal · Block AJAX. Not in CISA KEV. EPSS 0.2% (higher than 8.6% of CVEs). CVSS 9.8 CRITICAL. Priority 9.3 of 100.","summary":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX…","date_published":"2026-10-30T00:00:00.000Z","date_modified":"2026-10-30T20:16:54.000Z","tags":[],"_patchfirst":{"reason":"published","priority":9.3,"kev":null,"epss":{"score":0.00189,"percentile":0.08567},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Drupal","product":"Block AJAX","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-96355","url":"https://patchfirst.co/cve/CVE-2026-96355/","title":"CVE-2026-96355: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code…","content_text":"Drupal · Webform. Not in CISA KEV. EPSS 0.4% (higher than 36.4% of CVEs). CVSS 9.1 CRITICAL. Priority 15.6 of 100.","summary":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code…","date_published":"2026-10-22T00:00:00.000Z","date_modified":"2026-10-23T04:18:23.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.6,"kev":null,"epss":{"score":0.00421,"percentile":0.36417},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Drupal","product":"Webform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-9082#kev","url":"https://patchfirst.co/cve/CVE-2026-9082/","title":"[KEV] CVE-2026-9082: Drupal Core SQL Injection Vulnerability","content_text":"Drupal · Core. In CISA KEV since 2026-05-22. ENISA EUVD lists it as exploited. EPSS 89.4% (higher than 99.78% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.8 of 100.","summary":"Drupal Core SQL Injection Vulnerability","date_published":"2026-05-22T00:00:00.000Z","date_modified":"2026-10-07T19:17:45.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2026-05-22","ransomware":false},"epss":{"score":0.89381,"percentile":0.99784},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Drupal","product":"Core","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-7602#kev","url":"https://patchfirst.co/cve/CVE-2018-7602/","title":"[KEV] CVE-2018-7602: Drupal Core Remote Code Execution Vulnerability","content_text":"Drupal · Core. In CISA KEV since 2022-04-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.2% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1190 Exploit Public-Facing Application. Priority 79.8 of 100.","summary":"Drupal Core Remote Code Execution Vulnerability","date_published":"2022-04-13T00:00:00.000Z","date_modified":"2026-10-02T14:54:58.000Z","tags":["kev","ransomware","public-exploit","T1059","T1190"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2022-04-13","ransomware":true},"epss":{"score":0.99172,"percentile":0.99934},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Drupal","product":"Core","techniqueIds":["T1059","T1190"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-6340#kev","url":"https://patchfirst.co/cve/CVE-2019-6340/","title":"[KEV] CVE-2019-6340: Drupal Core Remote Code Execution Vulnerability","content_text":"Drupal · Core. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 92.0% (higher than 99.82% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 68.6 of 100.","summary":"Drupal Core Remote Code Execution Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T02:39:02.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":68.6,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.92017,"percentile":0.9982},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Drupal","product":"Core","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-13671#kev","url":"https://patchfirst.co/cve/CVE-2020-13671/","title":"[KEV] CVE-2020-13671: Drupal core Un-restricted Upload of File","content_text":"Drupal · Drupal core. In CISA KEV since 2022-01-18. ENISA EUVD lists it as exploited. EPSS 36.2% (higher than 98.5% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.9 of 100.","summary":"Drupal core Un-restricted Upload of File","date_published":"2022-01-18T00:00:00.000Z","date_modified":"2026-06-17T02:53:32.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.9,"kev":{"dateAdded":"2022-01-18","ransomware":false},"epss":{"score":0.36167,"percentile":0.98474},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Drupal","product":"Drupal core","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-7600#kev","url":"https://patchfirst.co/cve/CVE-2018-7600/","title":"[KEV] CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability","content_text":"Drupal · Drupal Core. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1485 Data Destruction; T1496 Resource Hijacking. Named in 1 threat report. Priority 83.7 of 100.","summary":"Drupal Core Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:03:25.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1485","T1496"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99991,"percentile":0.99985},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Drupal","product":"Drupal Core","techniqueIds":["T1190","T1059","T1485","T1496"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-6922","url":"https://patchfirst.co/cve/CVE-2017-6922/","title":"CVE-2017-6922: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users","content_text":"Drupal · Drupal Core. Not in CISA KEV. EPSS 1.9% (higher than 80.2% of CVEs). Priority 51.0 of 100.","summary":"Files uploaded by anonymous users into a private file system can be accessed by other anonymous users","date_published":"2019-01-22T00:00:00.000Z","date_modified":"2024-09-16T19:04:17.000Z","tags":[],"_patchfirst":{"reason":"published","priority":51,"kev":null,"epss":{"score":0.01947,"percentile":0.80174},"cvss":null,"vendor":"Drupal","product":"Drupal Core","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}