# Drupal

Latest release: 11.4.11. Known vulnerabilities: 156. Actively exploited: 6. Vendor advisories: [https://www.drupal.org/security](https://www.drupal.org/security)

Check any version: https://fixedin.dev/drupal/{version}.md (for example https://fixedin.dev/drupal/11.4.11.md).

## Release lines

| Line | Latest | Status | Check |
|---|---|---|---|
| 11.4 | 11.4.11 | supported until 2027-07-07 | https://fixedin.dev/drupal/11.4.11.md |
| 11.3 | 11.3.20 | supported until 2026-12-16 | https://fixedin.dev/drupal/11.3.20.md |
| 10.6 | 10.6.20 | supported until 2026-12-16 | https://fixedin.dev/drupal/10.6.20.md |
| 11.2 | 11.2.14 | end of life since 2026-07-01 | https://fixedin.dev/drupal/11.2.14.md |
| 10.5 | 10.5.12 | end of life since 2026-07-01 | https://fixedin.dev/drupal/10.5.12.md |
| 10.4 | 10.4.10 | end of life since 2025-12-10 | https://fixedin.dev/drupal/10.4.10.md |
| 11.1 | 11.1.10 | end of life since 2025-12-10 | https://fixedin.dev/drupal/11.1.10.md |
| 11.0 | 11.0.13 | end of life since 2025-06-16 | https://fixedin.dev/drupal/11.0.13.md |
| 10.3 | 10.3.14 | end of life since 2025-06-16 | https://fixedin.dev/drupal/10.3.14.md |
| 10.2 | 10.2.12 | end of life since 2024-12-17 | https://fixedin.dev/drupal/10.2.12.md |
| 10.1 | 10.1.8 | end of life since 2024-06-20 | https://fixedin.dev/drupal/10.1.8.md |
| 10.0 | 10.0.11 | end of life since 2023-12-15 | https://fixedin.dev/drupal/10.0.11.md |
| 9.5 | 9.5.11 | end of life since 2023-11-01 | https://fixedin.dev/drupal/9.5.11.md |
| 9.4 | 9.4.15 | end of life since 2023-06-21 | https://fixedin.dev/drupal/9.4.15.md |
| 9.3 | 9.3.22 | end of life since 2022-12-14 | https://fixedin.dev/drupal/9.3.22.md |
| 9.2 | 9.2.21 | end of life since 2022-06-15 | https://fixedin.dev/drupal/9.2.21.md |
| 9.1 | 9.1.15 | end of life since 2021-12-08 | https://fixedin.dev/drupal/9.1.15.md |
| 9.0 | 9.0.14 | end of life since 2021-06-16 | https://fixedin.dev/drupal/9.0.14.md |
| 8.9 | 8.9.20 | end of life since 2021-11-02 | https://fixedin.dev/drupal/8.9.20.md |
| 8.8 | 8.8.12 | end of life since 2020-12-01 | https://fixedin.dev/drupal/8.8.12.md |
| 7 | 7.103 | end of life since 2025-01-05 | https://fixedin.dev/drupal/7.103.md |

## Actively exploited

- [CVE-2026-9082](https://www.drupal.org/sa-core-2026-004), added to CISA KEV 2026-05-22
- [CVE-2020-28949](https://osv.dev/vulnerability/DRUPAL-CORE-2020-013), added to CISA KEV 2022-08-25
- [CVE-2018-7602](https://www.debian.org/security/2018/dsa-4180), added to CISA KEV 2022-04-13
- [CVE-2019-6340](https://www.synology.com/security/advisory/Synology_SA_19_09), added to CISA KEV 2022-03-25
- [CVE-2020-13671](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/), added to CISA KEV 2022-01-18
- [CVE-2018-7600](https://osv.dev/vulnerability/DRUPAL-CORE-2018-002), added to CISA KEV 2021-11-03

Data as of: 2026-10-24 20:37 UTC

---

FixedIn gives information, not guarantees. Always confirm with the vendor's advisory before you rely on a result. Source: https://fixedin.dev/drupal · JSON: https://fixedin.dev/drupal.json · MCP server: https://fixedin.dev/mcp · About these addresses: https://fixedin.dev/llms.txt