Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2026-9082 — Drupal Core SQL Injection Vulnerability
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
|
Drupal | Drupal Core | May 22, 2026 | May 27, 2026 | |
|
CVE-2018-7602 — Drupal Core Remote Code Execution Vulnerability
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
|
Drupal | Drupal Core | Apr 13, 2022 | May 4, 2022 | Ransomware |
|
CVE-2019-6340 — Drupal Core Remote Code Execution Vulnerability
In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.
|
Drupal | Drupal Core | Mar 25, 2022 | Apr 15, 2022 | |
|
CVE-2020-13671 — Drupal core Un-restricted Upload of File
Improper sanitization in the extension file names is present in Drupal core.
|
Drupal | Drupal Core | Jan 18, 2022 | Jul 18, 2022 | |
|
CVE-2018-7600 — Drupal Core Remote Code Execution Vulnerability
Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.
|
Drupal | Drupal Core | Nov 3, 2021 | May 3, 2022 | Ransomware |
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
Drupal Core · May 22, 2026
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
Drupal Core · Apr 13, 2022
In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.
Drupal Core · Mar 25, 2022
Improper sanitization in the extension file names is present in Drupal core.
Drupal Core · Jan 18, 2022
Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.
Drupal Core · Nov 3, 2021