Patchfirst: Drupal vulnerabilitieshttps://patchfirst.co/vendor/drupal/New and newly exploited Drupal CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2026-118539: Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsinghttps://patchfirst.co/cve/CVE-2026-118539/CVE-2026-118539Fri, 30 Oct 2026 00:00:00 GMTDrupal · Commerce Core. Not in CISA KEV. EPSS 0.2% (higher than 12.8% of CVEs). CVSS 6.5 MEDIUM. Priority 52.8 of 100.CVE-2026-107249: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX…https://patchfirst.co/cve/CVE-2026-107249/CVE-2026-107249Fri, 30 Oct 2026 00:00:00 GMTDrupal · Block AJAX. Not in CISA KEV. EPSS 0.2% (higher than 8.6% of CVEs). CVSS 9.8 CRITICAL. Priority 9.3 of 100.CVE-2026-96355: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code…https://patchfirst.co/cve/CVE-2026-96355/CVE-2026-96355Thu, 22 Oct 2026 00:00:00 GMTDrupal · Webform. Not in CISA KEV. EPSS 0.4% (higher than 36.4% of CVEs). CVSS 9.1 CRITICAL. Priority 15.6 of 100.[KEV] CVE-2026-9082: Drupal Core SQL Injection Vulnerabilityhttps://patchfirst.co/cve/CVE-2026-9082/CVE-2026-9082#kevFri, 22 May 2026 00:00:00 GMTDrupal · Core. In CISA KEV since 2026-05-22. ENISA EUVD lists it as exploited. EPSS 89.4% (higher than 99.78% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.8 of 100.kevpublic-exploitT1190T1059[KEV] CVE-2018-7602: Drupal Core Remote Code Execution Vulnerabilityhttps://patchfirst.co/cve/CVE-2018-7602/CVE-2018-7602#kevWed, 13 Apr 2022 00:00:00 GMTDrupal · Core. In CISA KEV since 2022-04-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.2% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1190 Exploit Public-Facing Application. Priority 79.8 of 100.kevransomwarepublic-exploitT1059T1190[KEV] CVE-2019-6340: Drupal Core Remote Code Execution Vulnerabilityhttps://patchfirst.co/cve/CVE-2019-6340/CVE-2019-6340#kevFri, 25 Mar 2022 00:00:00 GMTDrupal · Core. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 92.0% (higher than 99.82% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 68.6 of 100.kevpublic-exploitT1190T1059[KEV] CVE-2020-13671: Drupal core Un-restricted Upload of Filehttps://patchfirst.co/cve/CVE-2020-13671/CVE-2020-13671#kevTue, 18 Jan 2022 00:00:00 GMTDrupal · Drupal core. In CISA KEV since 2022-01-18. ENISA EUVD lists it as exploited. EPSS 36.2% (higher than 98.5% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.9 of 100.kevpublic-exploitT1190T1059[KEV] CVE-2018-7600: Drupal Core Remote Code Execution Vulnerabilityhttps://patchfirst.co/cve/CVE-2018-7600/CVE-2018-7600#kevWed, 03 Nov 2021 00:00:00 GMTDrupal · Drupal Core. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1485 Data Destruction; T1496 Resource Hijacking. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1190T1059T1485T1496CVE-2017-6922: Files uploaded by anonymous users into a private file system can be accessed by other anonymous usershttps://patchfirst.co/cve/CVE-2017-6922/CVE-2017-6922Tue, 22 Jan 2019 00:00:00 GMTDrupal · Drupal Core. Not in CISA KEV. EPSS 1.9% (higher than 80.2% of CVEs). Priority 51.0 of 100.