Three vulnerabilities were patched Wednesday in the Drupal content management system’s core engine, two of which were rated critical.