0dayNews — DrupalDrupal security advisories covering core vulnerabilities and flaws in contributed modules and themes. Drupal powers millions of sites, including government and enterprise deployments, making critical-severity patches high-priority events for site owners and hosting providers alike. Combined article + CVE feed for the Drupal beat.https://0daynews.com/en-usDrupal Core RCE Flaws: Patch Now, Exploits Cominghttps://0daynews.com/articles/2026-10-19-drupal-core-rce-entity-list-field-ui-patches/https://0daynews.com/articles/2026-10-19-drupal-core-rce-entity-list-field-ui-patches/Drupal patches two critical RCEs in Field UI and Entity List. No exploitation confirmed yet, but exploits expected within hours of disclosure. Patch core to 11.4.10 or later.Mon, 19 Oct 2026 22:00:00 GMTDrupalarticleCVE-2020-13671 — Drupal core Un-restricted Upload of Filehttps://0daynews.com/cve/cve-2020-13671/https://0daynews.com/cve/cve-2020-13671/Improper sanitization in the extension file names is present in Drupal core.Sat, 17 Oct 2026 00:00:00 GMTDrupalhighcveCVE-2018-7600 — Drupal Core Remote Code Execution Vulnerabilityhttps://0daynews.com/cve/cve-2018-7600/https://0daynews.com/cve/cve-2018-7600/Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.Wed, 14 Oct 2026 00:00:00 GMTDrupalcriticalcveCVE-2018-7602 — Drupal Core Remote Code Execution Vulnerabilityhttps://0daynews.com/cve/cve-2018-7602/https://0daynews.com/cve/cve-2018-7602/A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.Wed, 14 Oct 2026 00:00:00 GMTDrupalcriticalcveCVE-2019-6340 — Drupal Core Remote Code Execution Vulnerabilityhttps://0daynews.com/cve/cve-2019-6340/https://0daynews.com/cve/cve-2019-6340/In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.Wed, 14 Oct 2026 00:00:00 GMTDrupalhighcveCVE-2026-9082 — Drupal Core SQL Injection Vulnerabilityhttps://0daynews.com/cve/cve-2026-9082/https://0daynews.com/cve/cve-2026-9082/Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.Wed, 14 Oct 2026 00:00:00 GMTDrupalcriticalcve