pwned.coffeeUpdated 7 min ago

The menu

Drupal / Joomla

Operational

Nothing about Drupal / Joomla is on fire right now. We'd tell you. Probably.

2 spills in 12 months for Drupal / Joomla

Week of 18 May 2026: 1 newWeek of 15 Jun 2026: 1 new
Worst week: 18 May 2026, 1 new spill.

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

  1. highpatchedexploited Widget Factory Joomla Content Editor Improper Access Control Vulnerability Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users. Added to CISA KEV on 2026-06-16 (federal deadline 2026-06-19). CVE-2026-489073 sources
  2. highpatchedexploited Drupal Core SQL Injection Vulnerability Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. Added to CISA KEV on 2026-05-22 (federal deadline 2026-05-27). CVE-2026-90822 sources

More in Web & runtimes

Follow Drupal / Joomla

RSS: /feed.xml?stack=drupal. JSON: /incidents.json?stack=drupal. Or add it to your usual for delivery.