Exposición de Drupal

CMS
284
score de exposición
94.439
sitios usan
4
en explotación
9
críticos
Análisis Vexday

Com 84 CVEs catalogadas e 4 confirmadas em exploração ativa pelo CISA KEV, o Drupal apresenta uma taxa de exploração 10,6 vezes acima da média geral do catálogo, o que indica que vulnerabilidades nessa plataforma atraem atenção desproporcional de agentes maliciosos. A CVE mais perigosa atualmente ativa é a CVE-2018-7600, com score EPSS de 0,9999 — praticamente certeza estatística de tentativa de exploração —, sinalizando que falhas antigas nessa base de código permanecem alvos prioritários mesmo anos após sua divulgação. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), enquanto 8 CVEs atingem severidade crítica e 5 surgiram nos últimos 90 dias, evidenciando uma superfície de ataque ainda ativa. Equipes responsáveis por instâncias Drupal devem tratar a aplicação de patches como prioridade contínua, com atenção especial a vulnerabilidades mais antigas que ainda não foram remediadas no ambiente.

CVEs

97 resultados
CVE-2026-55803MEDIUMDrupal core - Critical - PHP object injection - SA-CORE-2026-005EPSS 0.4%CVE-2026-55806MEDIUMDrupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007EPSS 0.3%CVE-2024-12393MEDIUMDrupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003EPSS 0.3%CVE-2025-12848HIGHXSS vulnerability when rendering filename in Webform MultiformEPSS 0.3%CVE-2026-81162MEDIUMDXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112EPSS 0.3%CVE-2025-13080MEDIUMDrupal core - Moderately critical - Denial of Service - SA-CORE-2025-005EPSS 0.3%CVE-2024-55635MEDIUMDrupal core - Critical - Cross Site Scripting - SA-CORE-2024-005EPSS 0.3%CVE-2025-3739MEDIUMDrupal 8 Google Optimize Hide Page - Critical - Unsupported - SA-CONTRIB-2025-040EPSS 0.3%CVE-2025-31673MEDIUMDrupal core - Moderately critical - Access bypass - SA-CORE-2025-002EPSS 0.3%CVE-2026-0750HIGHPayment bypass in Commerce PayboxEPSS 0.3%CVE-2025-3057MEDIUMDrupal core - Critical - Cross site scripting - SA-CORE-2025-001EPSS 0.3%CVE-2026-3216MEDIUMDrupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017EPSS 0.3%CVE-2024-24837MEDIUMCross-Site Request Forgery (CSRF) vulnerability in FG PrestaShop, FG Drupal and FG Joomla WordPress pluginsEPSS 0.3%CVE-2026-55808MEDIUMDrupal core - Moderately critical - Improper validation - SA-CORE-2026-009EPSS 0.3%CVE-2025-47706MEDIUMEnterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052EPSS 0.3%CVE-2025-13081MEDIUMDrupal core - Moderately critical - Gadget chain - SA-CORE-2025-006EPSS 0.3%CVE-2025-13083LOWDrupal core - Moderately critical - Information disclosure - SA-CORE-2025-008EPSS 0.3%CVE-2026-58587MEDIUMDrupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065EPSS 0.3%CVE-2026-58588MEDIUMDrupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066EPSS 0.3%CVE-2025-47709MEDIUMEnterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055EPSS 0.2%