Drupal 8.9
Support for Drupal 8.9 ended on 02/11/2021. There are no more security updates for this branch.
Latest version: 8.9.20, released on 17/11/2021
End of support: 02/11/2021
31 known vulnerabilities open in 8.9.20
Vulnerabilities in Drupal 8.9
52 vulnerabilities from the NVD affect at least one version of this branch. Last checked on 03/11/2026.
- CVE-2026-9082, CVSS 3.1: 9.8, actively exploited: still open in 8.9.20
- CVE-2024-55638, CVSS 3.1: 9.8: still open in 8.9.20
- CVE-2024-55637, CVSS 3.1: 9.8: still open in 8.9.20
- CVE-2024-55636, CVSS 3.1: 9.8: still open in 8.9.20
- CVE-2024-55634, CVSS 3.1: 8.1: still open in 8.9.20
- CVE-2025-31674, CVSS 3.1: 7.5: still open in 8.9.20
- CVE-2024-11941, CVSS 3.1: 7.5: still open in 8.9.20
- CVE-2023-5256, CVSS 3.1: 7.5: still open in 8.9.20
- CVE-2022-39261, CVSS 3.1: 7.5: still open in 8.9.20
- CVE-2022-25275, CVSS 3.1: 7.5: still open in 8.9.20
- CVE-2022-25273, CVSS 3.1: 7.5: still open in 8.9.20
- CVE-2022-24775, CVSS 3.1: 7.5: still open in 8.9.20
- CVE-2022-24729, CVSS 3.1: 7.5: still open in 8.9.20
- CVE-2022-25277, CVSS 3.1: 7.2: still open in 8.9.20
- CVE-2026-6366, CVSS 3.1: 6.6: still open in 8.9.20
- CVE-2022-25278, CVSS 3.1: 6.5: still open in 8.9.20
- CVE-2026-6365, CVSS 3.1: 6.1: still open in 8.9.20
- CVE-2025-3057, CVSS 3.1: 6.1: still open in 8.9.20
- CVE-2026-55806, CVSS 3.1: 5.9: still open in 8.9.20
- CVE-2026-55804, CVSS 3.1: 5.9: still open in 8.9.20
- CVE-2026-55803, CVSS 3.1: 5.9: still open in 8.9.20
- CVE-2025-13081, CVSS 3.1: 5.9: still open in 8.9.20
- CVE-2026-55808, CVSS 3.1: 5.4: still open in 8.9.20
- CVE-2025-31675, CVSS 3.1: 5.4: still open in 8.9.20
- CVE-2024-12393, CVSS 3.1: 5.4: still open in 8.9.20
- CVE-2022-24728, CVSS 3.1: 5.4: still open in 8.9.20
- CVE-2025-13080, CVSS 3.1: 5.3: still open in 8.9.20
- CVE-2025-31673, CVSS 3.1: 4.6: still open in 8.9.20
- CVE-2025-13082, CVSS 3.1: 4.3: still open in 8.9.20
- CVE-2025-13083, CVSS 3.1: 3.7: still open in 8.9.20
- CVE-2026-55807, CVSS 3.1: 3.1: still open in 8.9.20
- CVE-2020-13671, CVSS 3.1: 8.8, actively exploited: fixed in 8.9.9
- CVE-2020-28949, CVSS 3.1: 7.8, actively exploited: fixed in 8.9.10
- CVE-2020-36193, CVSS 3.1: 7.5, actively exploited: fixed in 8.9.13
- CVE-2020-13675, CVSS 3.1: 9.8: fixed in 8.9.19
- CVE-2020-13665, CVSS 3.1: 9.8: fixed in 8.9.1
- CVE-2020-13664, CVSS 3.1: 8.8: fixed in 8.9.1
- CVE-2020-13663, CVSS 3.1: 8.8: fixed in 8.9.1
- CVE-2020-28948, CVSS 3.1: 7.8: fixed in 8.9.10
- CVE-2020-13677, CVSS 3.1: 7.5: fixed in 8.9.19
- CVE-2020-13670, CVSS 3.1: 7.5: fixed in 8.9.6
- CVE-2020-13676, CVSS 3.1: 6.5: fixed in 8.9.19
- CVE-2020-13674, CVSS 3.1: 6.5: fixed in 8.9.19
- CVE-2021-33829, CVSS 3.1: 6.1: fixed in 8.9.16
- CVE-2020-13688, CVSS 3.1: 6.1: fixed in 8.9.6
- CVE-2020-13672, CVSS 3.1: 6.1: fixed in 8.9.14
- CVE-2020-13669, CVSS 3.1: 6.1: fixed in 8.9.6
- CVE-2020-13668, CVSS 3.1: 6.1: fixed in 8.9.6
- CVE-2020-13666, CVSS 3.1: 6.1: fixed in 8.9.6
- CVE-2021-41165, CVSS 3.1: 5.4: fixed in 8.9.20
- CVE-2021-41164, CVSS 3.1: 5.4: fixed in 8.9.20
- CVE-2020-13667, CVSS 3.1: 5.3: fixed in 8.9.6
462 vulnerabilities of Drupal have no version information in the NVD and are not assigned to any branch.
Get notified
Add Drupal with your version and Erseni Patch writes to you about new versions, vulnerabilities in exactly your version and the end of support.
Already have an account? Log in and add Drupal 8.9