# Drupal vulnerabilities

Source: https://junglewise.ai/threats/technologies/drupal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/drupal.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 14 vulnerabilities in Drupal: 0 in the last 7 days and 2 in the last 90 days, 1 of them critical and 1 exploited in the wild. The most recent, Drupal cross-site scripting in CKEditor WYSIWYG, was published on 16 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 2
- All time: 14 (1 critical, 1 exploited in the wild)

## About Drupal

Drupal is an open-source content management system written in PHP.

## Latest Drupal vulnerabilities

- [Drupal cross-site scripting in CKEditor WYSIWYG](https://junglewise.ai/threats/drupal-core-2026-013-the-drupal-project-uses-the-ckeditor-https-github-f5b3da40) (info, published 16 Sep 2026)
- [CVE-2026-15916: Drupal core missing authorization in image derivatives](https://junglewise.ai/threats/cve-2026-15916-drupal-core-missing-authorization-in-image-derivatives) (medium, CVSS 4.2, published 25 Aug 2026)
- [CVE-2026-55808: Drupal core XSS via improper image upload validation in JSON:API and REST](https://junglewise.ai/threats/cve-2026-55808-drupal-core-xss-via-improper-image-upload-validation-in-json-api) (info, CVSS 4.2, published 10 Jul 2026)
- [CVE-2026-55806: Drupal core open redirect and cache poisoning in rebuild.php](https://junglewise.ai/threats/cve-2026-55806-drupal-core-open-redirect-and-cache-poisoning-in-rebuild-php) (info, CVSS 3.7, published 10 Jul 2026)
- [CVE-2026-55803: Drupal core PHP object injection in JSON:API](https://junglewise.ai/threats/cve-2026-55803-drupal-core-php-object-injection-in-json-api) (info, CVSS 8.8, published 10 Jul 2026)
- [CVE-2026-9082: Drupal Drupal core SQL injection in database abstraction API](https://junglewise.ai/threats/cve-2026-9082-drupal-drupal-core-sql-injection-in-database-abstraction-api) (critical, exploited in the wild, CVSS 9.8, published 20 May 2026)
- [CVE-2026-6367: Drupal Drupal core stored XSS in CKEditor 5 entity suggestions](https://junglewise.ai/threats/cve-2026-6367-drupal-drupal-core-stored-xss-in-ckeditor-5-entity-suggestions) (medium, CVSS 6.1, published 19 May 2026)
- [CVE-2026-6366: Drupal Drupal core Object Injection gadget chain](https://junglewise.ai/threats/cve-2026-6366-drupal-drupal-core-object-injection-gadget-chain) (medium, CVSS 6.6, published 19 May 2026)
- [CVE-2026-6365: Drupal core cross-site scripting in AJAX modal dialog boxes](https://junglewise.ai/threats/cve-2026-6365-drupal-core-cross-site-scripting-in-ajax-modal-dialog-boxes) (medium, CVSS 6.1, published 19 May 2026)
- [CVE-2025-13083: Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels](https://junglewise.ai/threats/cve-2025-13083-drupal-core-2025-008-the-core-system-module-handles-downloads-of) (low, CVSS 3.7, published 18 Nov 2025)
- [CVE-2025-13082: Drupal core allows Content Spoofing](https://junglewise.ai/threats/cve-2025-13082-drupal-core-2025-007-by-generating-and-tricking-a-user-into) (medium, CVSS 4.3, published 18 Nov 2025)
- [CVE-2025-13081: Drupal core allows Object Injection](https://junglewise.ai/threats/cve-2025-13081-drupal-core-2025-006-drupal-core-contains-a-chain-of-methods-that) (medium, CVSS 5.9, published 18 Nov 2025)
- [CVE-2025-13080: Drupal core allows Forceful Browsing](https://junglewise.ai/threats/cve-2025-13080-drupal-core-2025-005-drupal-core-has-a-rarely-used-feature) (medium, CVSS 5.3, published 18 Nov 2025)
- [CVE-2018-9861: DRUPAL-CORE-2018-003 - CKEditor, a third-party JavaScript library included in Drupal core, has fixed a cross-site…](https://junglewise.ai/threats/cve-2018-9861-ckeditor-enhanced-image-plugin-cross-site-scripting-in-img-element) (low, CVSS 3, published 18 Apr 2018)

## Most severe Drupal vulnerabilities

- [CVE-2026-9082: Drupal Drupal core SQL injection in database abstraction API](https://junglewise.ai/threats/cve-2026-9082-drupal-drupal-core-sql-injection-in-database-abstraction-api) (critical, exploited in the wild, CVSS 9.8, published 20 May 2026)
- [CVE-2026-6366: Drupal Drupal core Object Injection gadget chain](https://junglewise.ai/threats/cve-2026-6366-drupal-drupal-core-object-injection-gadget-chain) (medium, CVSS 6.6, published 19 May 2026)
- [CVE-2026-6365: Drupal core cross-site scripting in AJAX modal dialog boxes](https://junglewise.ai/threats/cve-2026-6365-drupal-core-cross-site-scripting-in-ajax-modal-dialog-boxes) (medium, CVSS 6.1, published 19 May 2026)
- [CVE-2026-6367: Drupal Drupal core stored XSS in CKEditor 5 entity suggestions](https://junglewise.ai/threats/cve-2026-6367-drupal-drupal-core-stored-xss-in-ckeditor-5-entity-suggestions) (medium, CVSS 6.1, published 19 May 2026)
- [CVE-2025-13081: Drupal core allows Object Injection](https://junglewise.ai/threats/cve-2025-13081-drupal-core-2025-006-drupal-core-contains-a-chain-of-methods-that) (medium, CVSS 5.9, published 18 Nov 2025)
- [CVE-2025-13080: Drupal core allows Forceful Browsing](https://junglewise.ai/threats/cve-2025-13080-drupal-core-2025-005-drupal-core-has-a-rarely-used-feature) (medium, CVSS 5.3, published 18 Nov 2025)
- [CVE-2025-13082: Drupal core allows Content Spoofing](https://junglewise.ai/threats/cve-2025-13082-drupal-core-2025-007-by-generating-and-tricking-a-user-into) (medium, CVSS 4.3, published 18 Nov 2025)
- [CVE-2026-15916: Drupal core missing authorization in image derivatives](https://junglewise.ai/threats/cve-2026-15916-drupal-core-missing-authorization-in-image-derivatives) (medium, CVSS 4.2, published 25 Aug 2026)
- [CVE-2025-13083: Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels](https://junglewise.ai/threats/cve-2025-13083-drupal-core-2025-008-the-core-system-module-handles-downloads-of) (low, CVSS 3.7, published 18 Nov 2025)
- [CVE-2018-9861: DRUPAL-CORE-2018-003 - CKEditor, a third-party JavaScript library included in Drupal core, has fixed a cross-site…](https://junglewise.ai/threats/cve-2018-9861-ckeditor-enhanced-image-plugin-cross-site-scripting-in-img-element) (low, CVSS 3, published 18 Apr 2018)

## Vulnerabilities per week

Nothing in the last four weeks, down from 1 vulnerability in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 1 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 1 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other Drupal technologies

- [Drupal Webform](https://junglewise.ai/threats/technologies/webform): 20 vulnerabilities
- [Drupal Core](https://junglewise.ai/threats/technologies/drupal-core): 17 vulnerabilities
- [Drupal Ajenti Core](https://junglewise.ai/threats/technologies/core): 11 vulnerabilities
- [Drupal AI](https://junglewise.ai/threats/technologies/drupal-ai-1): 10 vulnerabilities
- [Drupal Commerce Core](https://junglewise.ai/threats/technologies/commerce-core): 4 vulnerabilities
- [Drupal Commerce Stripe](https://junglewise.ai/threats/technologies/commerce-stripe): 4 vulnerabilities
- [Drupal Authenticator Login Plus](https://junglewise.ai/threats/technologies/authenticator-login-plus): 3 vulnerabilities
- [Drupal Commerce License](https://junglewise.ai/threats/technologies/commerce-license): 3 vulnerabilities
- [Drupal Commerce](https://junglewise.ai/threats/technologies/drupal-commerce-1): 3 vulnerabilities
- [Drupal Gammu SMS Daemon](https://junglewise.ai/threats/technologies/gammu-sms-daemon): 3 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Drupal vulnerabilities", https://junglewise.ai/threats/technologies/drupal, 13 November 2026.