drupal
Safeguard articles tagged "drupal" — guides, analysis, and best practices for software supply chain and application security.
8 articles
CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability
CVE-2018-7600 affects Drupal Drupal Core and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2021-11-03.
CVE-2020-13671: Drupal core Un-restricted Upload of File
CVE-2020-13671 affects Drupal Drupal core and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2022-01-18.
CVE-2019-6340: Drupal Core Remote Code Execution Vulnerability
CVE-2019-6340 affects Drupal Core and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2022-03-25.
CVE-2018-7602: Drupal Core Remote Code Execution Vulnerability
CVE-2018-7602 affects Drupal Core and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2022-04-13.
CVE-2026-9082: Drupal Core SQL Injection Vulnerability
CVE-2026-9082 affects Drupal Core and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2026-05-22.
A Critical SQL Injection in Drupal Core's Database Abstraction Layer Is Being Actively Exploited
CVE-2026-9082 hits the shared database abstraction API every Drupal module and query routes through, confirmed exploited just two days after Drupal's own security advisory.
A hardening checklist for modern Drupal deployments
Drupal 7's 2025 end-of-life left unsupported sites exposed; here's a concrete checklist for module vetting, access control, and patch cadence on Drupal 10/11.
Drupalgeddon2 (CVE-2018-7600) Explained: Drupal's Form API RCE
CVE-2018-7600, known as Drupalgeddon2, is a CVSS 9.8 unauthenticated remote code execution flaw in Drupal core's Form API. Here is how the renderable-array bug works and which versions to run.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.