# Drupal vulnerabilities > Drupal has 850 published vulnerabilities across 143 products in our catalogue. 8 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Drupal, with 721. If you run Drupal software, patch the exploited flaws first. Canonical page: https://www.precursorintelligence.com/vendors/drupal ## At a glance - **Published vulnerabilities:** 850 - **Known to be exploited:** 8 - **Products:** 143 - **Versions:** 1,168 - **Most recently added to the known-exploited list:** [CVE-2026-9082](https://www.precursorintelligence.com/what-is/cve-2026-9082), 22 May 2026. We keep watching the list. ## Which Drupal products have the most vulnerabilities? - [Drupal](https://www.precursorintelligence.com/product/drupal/drupal): 721 published vulnerabilities, 489 versions - [Project Issue Tracking Module](https://www.precursorintelligence.com/product/drupal/project_issue_tracking_module): 6 published vulnerabilities, 6 versions - [Print](https://www.precursorintelligence.com/product/drupal/print): 5 published vulnerabilities, 55 versions - [Aggregation Module](https://www.precursorintelligence.com/product/drupal/aggregation_module): 4 published vulnerabilities, 8 versions - [Everyblog](https://www.precursorintelligence.com/product/drupal/everyblog): 4 published vulnerabilities, 2 versions - [Ubercart Module](https://www.precursorintelligence.com/product/drupal/ubercart_module): 4 published vulnerabilities, 1 version - [Project](https://www.precursorintelligence.com/product/drupal/project): 4 published vulnerabilities, 7 versions - [Shindig-Integrator](https://www.precursorintelligence.com/product/drupal/shindig-integrator): 3 published vulnerabilities, 1 version - [Drupal Project Issue Tracking](https://www.precursorintelligence.com/product/drupal/drupal_project_issue_tracking): 3 published vulnerabilities, 7 versions - [Content Construction Kit](https://www.precursorintelligence.com/product/drupal/content_construction_kit): 3 published vulnerabilities, 17 versions Each product page lists its own known-exploited flaws. ## Which Drupal vulnerabilities are being exploited? 8 flaws are on the government list of vulnerabilities known to be exploited, newest first: - [CVE-2026-9082](https://www.precursorintelligence.com/what-is/cve-2026-9082): Drupal Core SQL Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 16%, known exploited since 22 May 2026. - [CVE-2020-11023](https://www.precursorintelligence.com/what-is/cve-2020-11023): JQuery Cross-Site Scripting (XSS) Vulnerability. Medium, CVSS 6.9, chance of use in 30 days 85%, known exploited since 23 January 2025. - [CVE-2020-28949](https://www.precursorintelligence.com/what-is/cve-2020-28949): PEAR Archive\_Tar Deserialization of Untrusted Data Vulnerability. High, CVSS 7.8, chance of use in 30 days 85%, known exploited since 25 August 2022. - [CVE-2020-36193](https://www.precursorintelligence.com/what-is/cve-2020-36193): PEAR Archive\_Tar Improper Link Resolution Vulnerability. High, CVSS 7.5, chance of use in 30 days 71%, known exploited since 25 August 2022. - [CVE-2018-7602](https://www.precursorintelligence.com/what-is/cve-2018-7602): Drupal Core Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 13 April 2022. - [CVE-2019-6340](https://www.precursorintelligence.com/what-is/cve-2019-6340): Drupal Core Remote Code Execution Vulnerability. High, CVSS 8.1, chance of use in 30 days 92%, known exploited since 25 March 2022. - [CVE-2020-13671](https://www.precursorintelligence.com/what-is/cve-2020-13671): Drupal core Un-restricted Upload of File. High, CVSS 8.8, chance of use in 30 days 36%, known exploited since 18 January 2022. - [CVE-2018-7600](https://www.precursorintelligence.com/what-is/cve-2018-7600): Drupal Core Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021. ## Which Drupal flaws are most likely to be used? Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days): - [CVE-2018-7600](https://www.precursorintelligence.com/what-is/cve-2018-7600): >99%, Critical (CVSS 9.8), known exploited - [CVE-2014-3704](https://www.precursorintelligence.com/what-is/cve-2014-3704): >99%, High (CVSS 7.5) - [CVE-2020-11022](https://www.precursorintelligence.com/what-is/cve-2020-11022): >99%, Medium (CVSS 6.1) - [CVE-2018-7602](https://www.precursorintelligence.com/what-is/cve-2018-7602): >99%, Critical (CVSS 9.8), known exploited - [CVE-2019-6340](https://www.precursorintelligence.com/what-is/cve-2019-6340): 92%, High (CVSS 8.1), known exploited - [CVE-2019-11358](https://www.precursorintelligence.com/what-is/cve-2019-11358): 87%, Medium (CVSS 6.1) - [CVE-2020-11023](https://www.precursorintelligence.com/what-is/cve-2020-11023): 85%, Medium (CVSS 6.9), known exploited - [CVE-2020-28949](https://www.precursorintelligence.com/what-is/cve-2020-28949): 85%, High (CVSS 7.8), known exploited - [CVE-2014-9016](https://www.precursorintelligence.com/what-is/cve-2014-9016): 82%, Medium (CVSS 5.0) ## All Drupal products we track 110 products with at least one tracked version, most vulnerabilities first: - [Drupal](https://www.precursorintelligence.com/product/drupal/drupal): 721 vulnerabilities, 489 versions - [Project Issue Tracking Module](https://www.precursorintelligence.com/product/drupal/project_issue_tracking_module): 6 vulnerabilities, 6 versions - [Print](https://www.precursorintelligence.com/product/drupal/print): 5 vulnerabilities, 55 versions - [Aggregation Module](https://www.precursorintelligence.com/product/drupal/aggregation_module): 4 vulnerabilities, 8 versions - [Everyblog](https://www.precursorintelligence.com/product/drupal/everyblog): 4 vulnerabilities, 2 versions - [Ubercart Module](https://www.precursorintelligence.com/product/drupal/ubercart_module): 4 vulnerabilities, 1 version - [Project](https://www.precursorintelligence.com/product/drupal/project): 4 vulnerabilities, 7 versions - [Shindig-Integrator](https://www.precursorintelligence.com/product/drupal/shindig-integrator): 3 vulnerabilities, 1 version - [Drupal Project Issue Tracking](https://www.precursorintelligence.com/product/drupal/drupal_project_issue_tracking): 3 vulnerabilities, 7 versions - [Content Construction Kit](https://www.precursorintelligence.com/product/drupal/content_construction_kit): 3 vulnerabilities, 17 versions - [Talk](https://www.precursorintelligence.com/product/drupal/talk): 2 vulnerabilities, 5 versions - [Data](https://www.precursorintelligence.com/product/drupal/data): 2 vulnerabilities, 1 version - [Taxonomy Autotagger Module](https://www.precursorintelligence.com/product/drupal/taxonomy_autotagger_module): 2 vulnerabilities, 1 version - [Database Administration Module](https://www.precursorintelligence.com/product/drupal/database_administration_module): 2 vulnerabilities, 2 versions - [Artificial Intelligence](https://www.precursorintelligence.com/product/drupal/artificial_intelligence): 2 vulnerabilities, 6 versions - [Chatroom Module](https://www.precursorintelligence.com/product/drupal/chatroom_module): 2 vulnerabilities, 1 version - [Localization Client](https://www.precursorintelligence.com/product/drupal/localization_client): 2 vulnerabilities, 11 versions - [Trailscout Module](https://www.precursorintelligence.com/product/drupal/trailscout_module): 2 vulnerabilities, 6 versions - [User Karma Module](https://www.precursorintelligence.com/product/drupal/user_karma_module): 2 vulnerabilities, 13 versions - [Views](https://www.precursorintelligence.com/product/drupal/views): 2 vulnerabilities, 6 versions - [Drupal Easylinks Module](https://www.precursorintelligence.com/product/drupal/drupal_easylinks_module): 2 vulnerabilities, 4 versions - [Secure Site Module](https://www.precursorintelligence.com/product/drupal/secure_site_module): 2 vulnerabilities, 2 versions - [Ajax Checklist](https://www.precursorintelligence.com/product/drupal/ajax_checklist): 2 vulnerabilities, 1 version - [Brilliant Gallery](https://www.precursorintelligence.com/product/drupal/brilliant_gallery): 2 vulnerabilities, 25 versions - [Custom Search Module](https://www.precursorintelligence.com/product/drupal/custom_search_module): 2 vulnerabilities, 28 versions - [Activity](https://www.precursorintelligence.com/product/drupal/activity): 2 vulnerabilities, 1 version - [Feedapi Mapper](https://www.precursorintelligence.com/product/drupal/feedapi_mapper): 1 vulnerability, 2 versions - [Fileshare Module](https://www.precursorintelligence.com/product/drupal/fileshare_module): 1 vulnerability, 2 versions - [Getid3](https://www.precursorintelligence.com/product/drupal/getid3): 1 vulnerability, 1 version - [Header Image](https://www.precursorintelligence.com/product/drupal/header_image): 1 vulnerability, 1 version - [Internationalization](https://www.precursorintelligence.com/product/drupal/internationalization): 1 vulnerability, 1 version - [Job Search](https://www.precursorintelligence.com/product/drupal/job_search): 1 vulnerability, 1 version - [Jquery UI Checkboxradio](https://www.precursorintelligence.com/product/drupal/jquery_ui_checkboxradio): 1 vulnerability, 4 versions - [Link Module](https://www.precursorintelligence.com/product/drupal/link_module): 1 vulnerability, 1 version - [Link to Us](https://www.precursorintelligence.com/product/drupal/link_to_us): 1 vulnerability, 1 version - [Localization Server](https://www.precursorintelligence.com/product/drupal/localization_server): 1 vulnerability, 5 versions - [Maestro](https://www.precursorintelligence.com/product/drupal/maestro): 1 vulnerability, 5 versions - [Magic Tabs Module](https://www.precursorintelligence.com/product/drupal/magic_tabs_module): 1 vulnerability, 1 version - [Mailhandler](https://www.precursorintelligence.com/product/drupal/mailhandler): 1 vulnerability, 8 versions - [Mailsave](https://www.precursorintelligence.com/product/drupal/mailsave): 1 vulnerability, 9 versions - [Mayo](https://www.precursorintelligence.com/product/drupal/mayo): 1 vulnerability, 3 versions - [Modal Frame](https://www.precursorintelligence.com/product/drupal/modal_frame): 1 vulnerability, 9 versions - [Newsflash](https://www.precursorintelligence.com/product/drupal/newsflash): 1 vulnerability, 9 versions - [News Page](https://www.precursorintelligence.com/product/drupal/news_page): 1 vulnerability, 2 versions - [Nivo Slider](https://www.precursorintelligence.com/product/drupal/nivo_slider): 1 vulnerability, 11 versions - [Nodeaccess Userreference](https://www.precursorintelligence.com/product/drupal/nodeaccess_userreference): 1 vulnerability, 14 versions - [Node Clone](https://www.precursorintelligence.com/product/drupal/node_clone): 1 vulnerability, 7 versions - [Nodefamily](https://www.precursorintelligence.com/product/drupal/nodefamily): 1 vulnerability, 1 version - [Node Hierarchy Module](https://www.precursorintelligence.com/product/drupal/node_hierarchy_module): 1 vulnerability, 2 versions - [Nodequeue](https://www.precursorintelligence.com/product/drupal/nodequeue): 1 vulnerability, 13 versions - [Openid](https://www.precursorintelligence.com/product/drupal/openid): 1 vulnerability, 1 version - [Organic Groups Menu](https://www.precursorintelligence.com/product/drupal/organic_groups_menu): 1 vulnerability, 2 versions - [Organic Groups Module](https://www.precursorintelligence.com/product/drupal/organic_groups_module): 1 vulnerability, 2 versions - [Outline Designer Module](https://www.precursorintelligence.com/product/drupal/outline_designer_module): 1 vulnerability, 1 version - [Petition Node Module](https://www.precursorintelligence.com/product/drupal/petition_node_module): 1 vulnerability, 4 versions - [Plus1](https://www.precursorintelligence.com/product/drupal/plus1): 1 vulnerability, 9 versions - [Professional Theme](https://www.precursorintelligence.com/product/drupal/professional_theme): 1 vulnerability, 16 versions - [Project Issue File Review](https://www.precursorintelligence.com/product/drupal/project_issue_file_review): 1 vulnerability, 14 versions - [Protected Node Module](https://www.precursorintelligence.com/product/drupal/protected_node_module): 1 vulnerability, 9 versions - [Quick Tabs](https://www.precursorintelligence.com/product/drupal/quick_tabs): 1 vulnerability, 8 versions - [Quiz](https://www.precursorintelligence.com/product/drupal/quiz): 1 vulnerability, 6 versions - [Randomizer](https://www.precursorintelligence.com/product/drupal/randomizer): 1 vulnerability, 2 versions - [Realname](https://www.precursorintelligence.com/product/drupal/realname): 1 vulnerability, 1 version - [Responsive Menus](https://www.precursorintelligence.com/product/drupal/responsive_menus): 1 vulnerability, 1 version - [SAML Sp 2.0 Single Sign on](https://www.precursorintelligence.com/product/drupal/saml_sp_2.0_single_sign_on): 1 vulnerability, 4 versions - [Search Keyword Module](https://www.precursorintelligence.com/product/drupal/search_keyword_module): 1 vulnerability, 3 versions - [Services Module for Drupal](https://www.precursorintelligence.com/product/drupal/services_module_for_drupal): 1 vulnerability, 1 version - [Simplecorp](https://www.precursorintelligence.com/product/drupal/simplecorp): 1 vulnerability, 1 version - [Skeleton Theme](https://www.precursorintelligence.com/product/drupal/skeleton_theme): 1 vulnerability, 2 versions - [Stock Module](https://www.precursorintelligence.com/product/drupal/stock_module): 1 vulnerability, 1 version - [Storage API](https://www.precursorintelligence.com/product/drupal/storage_api): 1 vulnerability, 7 versions - [Storm](https://www.precursorintelligence.com/product/drupal/storm): 1 vulnerability, 33 versions - [Suggested Terms Module](https://www.precursorintelligence.com/product/drupal/suggested_terms_module): 1 vulnerability, 1 version - [Svg Sanitizer](https://www.precursorintelligence.com/product/drupal/svg_sanitizer): 1 vulnerability, 7 versions - [Taxonomy Image Module](https://www.precursorintelligence.com/product/drupal/taxonomy_image_module): 1 vulnerability, 2 versions - [Taxonomy Manager](https://www.precursorintelligence.com/product/drupal/taxonomy_manager): 1 vulnerability, 5 versions - [Textimage](https://www.precursorintelligence.com/product/drupal/textimage): 1 vulnerability, 2 versions - [Tinytax Taxonomy Block Module](https://www.precursorintelligence.com/product/drupal/tinytax_taxonomy_block_module): 1 vulnerability, 1 version - [Tribune](https://www.precursorintelligence.com/product/drupal/tribune): 1 vulnerability, 3 versions - [Userpoints Module](https://www.precursorintelligence.com/product/drupal/userpoints_module): 1 vulnerability, 2 versions - [Zen](https://www.precursorintelligence.com/product/drupal/zen): 1 vulnerability, 8 versions - [Authenticated User Page Caching](https://www.precursorintelligence.com/product/drupal/authenticated_user_page_caching): 1 vulnerability, 13 versions - [Avatar Uploader](https://www.precursorintelligence.com/product/drupal/avatar_uploader): 1 vulnerability, 1 version - [Bluemasters](https://www.precursorintelligence.com/product/drupal/bluemasters): 1 vulnerability, 1 version - [Cck Comment Reference](https://www.precursorintelligence.com/product/drupal/cck_comment_reference): 1 vulnerability, 2 versions - [Comment Mail](https://www.precursorintelligence.com/product/drupal/comment_mail): 1 vulnerability, 3 versions - [Comment Upload Module](https://www.precursorintelligence.com/product/drupal/comment_upload_module): 1 vulnerability, 2 versions - [Commons](https://www.precursorintelligence.com/product/drupal/commons): 1 vulnerability, 6 versions - [Context Form Alteration Module](https://www.precursorintelligence.com/product/drupal/context_form_alteration_module): 1 vulnerability, 2 versions - [Cvs Management and Tracker](https://www.precursorintelligence.com/product/drupal/cvs_management_and_tracker): 1 vulnerability, 2 versions - [Devel Module](https://www.precursorintelligence.com/product/drupal/devel_module): 1 vulnerability, 23 versions - [Doubleclick for Publishers](https://www.precursorintelligence.com/product/drupal/doubleclick_for_publishers): 1 vulnerability, 2 versions - [Drupal Docker Images](https://www.precursorintelligence.com/product/drupal/drupal_docker_images): 1 vulnerability, 3 versions - [Drupal E-Commerce Module](https://www.precursorintelligence.com/product/drupal/drupal_e-commerce_module): 1 vulnerability, 1 version - [Drupal Mysite](https://www.precursorintelligence.com/product/drupal/drupal_mysite): 1 vulnerability, 2 versions - [Drupal Pathauto Module](https://www.precursorintelligence.com/product/drupal/drupal_pathauto_module): 1 vulnerability, 2 versions - [Drupal Project](https://www.precursorintelligence.com/product/drupal/drupal_project): 1 vulnerability, 5 versions - [Drupal Pubcookie Module](https://www.precursorintelligence.com/product/drupal/drupal_pubcookie_module): 1 vulnerability, 2 versions - [Drupal Userreview Module](https://www.precursorintelligence.com/product/drupal/drupal_userreview_module): 1 vulnerability, 1 version - [Entity Embed](https://www.precursorintelligence.com/product/drupal/entity_embed): 1 vulnerability, 4 versions - [Extended Tracker](https://www.precursorintelligence.com/product/drupal/extended_tracker): 1 vulnerability, 1 version - [Faq](https://www.precursorintelligence.com/product/drupal/faq): 1 vulnerability, 15 versions - [Feature Module](https://www.precursorintelligence.com/product/drupal/feature_module): 1 vulnerability, 2 versions - [Acidfree](https://www.precursorintelligence.com/product/drupal/acidfree): 1 vulnerability, 2 versions - [Views Builk Operations](https://www.precursorintelligence.com/product/drupal/views_builk_operations): 1 vulnerability, 8 versions - [Views Bulk Operations](https://www.precursorintelligence.com/product/drupal/views_bulk_operations): 1 vulnerability, 9 versions - [Views Dynamic Field](https://www.precursorintelligence.com/product/drupal/views_dynamic_field): 1 vulnerability, 6 versions - [Webform Module](https://www.precursorintelligence.com/product/drupal/webform_module): 1 vulnerability, 12 versions - [Restful](https://www.precursorintelligence.com/product/drupal/restful): 0 vulnerabilities, 17 versions - [Web Links](https://www.precursorintelligence.com/product/drupal/web_links): 0 vulnerabilities, 41 versions ## Questions ### How many vulnerabilities does Drupal have? Our catalogue lists 850 published vulnerabilities across 143 products and 1,168 versions from Drupal. The most recent Drupal flaw added to the known-exploited list is CVE-2026-9082, on 22 May 2026. ### Which Drupal vulnerabilities are being exploited? 8 Drupal vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2026-9082, CVE-2020-11023 and CVE-2020-28949. The full list is on this page. ### Which Drupal product has the most vulnerabilities? Drupal, with 721 published vulnerabilities. Its own page lists the ones known to be exploited. ### How do I get alerts for new Drupal vulnerabilities? Create a Precursor Intelligence account and track the Drupal products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook. ## Running Drupal? Precursor Intelligence keeps checking for you: - **Tell us what you run.** Pick your software from a list, or let us work it out from your website. - **We match it to every flaw.** Over 400,000 published flaws, checked against your list. - **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it. - **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools. Start free (no card, nothing to install): https://www.precursorintelligence.com/register Book a demo: https://www.precursorintelligence.com/contact