CVE-2026-9082 — Drupal, Joomla Actively Exploited CVE
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
CVSS 9.8. Unauthenticated SQL injection in Drupal Core. Added to CISA KEV two days after disclosure. 15,000 attacks across 65 countries. The CMS governments cho
Drupal has more KEV entries than any CMS. The latest PostgreSQL RCE was added May 2026.
CVE-2026-48907 is a CVSS 10.0 flaw in the Joomla Content Editor plugin. Attackers upload PHP web shells through unauthenticated profile imports. CISA orders fed
Binding Operational Directive 26-04 replaces the old 30-day patch window with risk-based timelines. Publicly exposed, auto-exploitable vulnerabilities in the KE
TYPO3-CORE-SA-2026-019. Broken access control in the Form Framework allows maliciously crafted form definitions to execute arbitrary SQL and create admin accoun
CVE-2026-9082. Highly critical. Anonymous SQL injection in Drupal core — not a contributed module, not a plugin, the core framework itself. CISA added it to the