Drupal Vulnerabilities and Affected Products
Vulnerabilities associated with Drupal Core.
Products
Clear product- Drupal Core49 vulnerabilities
- Core21 vulnerabilities
- AI (Artificial Intelligence)8 vulnerabilities
- Open Social8 vulnerabilities
- Enterprise MFA - TFA for Drupal6 vulnerabilities
- COOKiES Consent Management4 vulnerabilities
- Drupal4 vulnerabilities
- Drupal Canvas4 vulnerabilities
- Two-factor Authentication (TFA)4 vulnerabilities
- Authenticator Login3 vulnerabilities
- Facets3 vulnerabilities
- Login Disable3 vulnerabilities
- One Time Password3 vulnerabilities
- OpenID Connect / OAuth client3 vulnerabilities
- Tagify3 vulnerabilities
- Access code2 vulnerabilities
- Acquia DAM2 vulnerabilities
- Advanced Content Feedback (aka admin_feedback)2 vulnerabilities
- AI Agents2 vulnerabilities
- Anti-Spam by CleanTalk2 vulnerabilities
- CivicTheme Design System2 vulnerabilities
- Colorbox2 vulnerabilities
- Data-module2 vulnerabilities
- drupal_core2 vulnerabilities
- ECA: Event - Condition - Action2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-55808MEDIUM | Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*. CWE-79Jul 10, 2026 | CVSS5.4v3.1 | EPSS0.161% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*. CWE-918Jul 10, 2026 | CVSS3.1v3.1 | EPSS0.14% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-55806MEDIUM | Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*. CWE-601Jul 10, 2026 | CVSS5.9v3.1 | EPSS0.206% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-55804MEDIUM | Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*. CWE-915Jul 10, 2026 | CVSS5.9v3.1 | EPSS0.215% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-55803MEDIUM | Drupal core - Critical - PHP object injection - SA-CORE-2026-005Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*. CWE-915Jul 10, 2026 | CVSS5.9v3.1 | EPSS0.215% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-9082CRITICAL | Drupal core - Highly critical - SQL injection - SA-CORE-2026-004Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10. | CVSS9.8v3.1 | EPSS88.3% | PoCs13 | SignalsListed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2026-6367MEDIUM | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7. CWE-79May 19, 2026 | CVSS6.1v3.1 | EPSS0.201% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-6366MEDIUM | Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7. CWE-915May 19, 2026 | CVSS6.6v3.1 | EPSS0.399% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-6365MEDIUM | Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7. CWE-79May 19, 2026 | CVSS6.1v3.1 | EPSS0.238% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103. CWE-525Nov 18, 2025 | CVSS-v4.0 | EPSS0.264% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Drupal core - Moderately critical - Defacement - SA-CORE-2025-007User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. CWE-451Nov 18, 2025 | CVSS-v4.0 | EPSS0.222% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. | CVSS-v4.0 | EPSS0.255% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. CWE-754Nov 18, 2025 | CVSS-v4.0 | EPSS0.316% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12. CWE-79Mar 31, 2025 | CVSS-v4.0 | EPSS0.467% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. | CVSS-v4.0 | EPSS0.55% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. CWE-863Mar 31, 2025 | CVSS-v4.0 | EPSS0.293% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2025-3057MEDIUM | Drupal core - Critical - Cross site scripting - SA-CORE-2025-001Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. CWE-79Mar 31, 2025 | CVSS6.1v3.1 | EPSS0.287% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to an… | CVSS-v4.0 | EPSS0.956% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due t… | CVSS-v4.0 | EPSS0.803% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Drupal core - Less critical - Gadget chain - SA-CORE-2024-006Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so called gadget chain presents no direct threat, but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due … | CVSS-v4.0 | EPSS0.904% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2024-55635MEDIUM | Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 7.0 before 7.102. CWE-79Dec 9, 2024 | CVSS6.1v3.1 | EPSS0.314% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. | CVSS-v4.0 | EPSS0.408% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. CWE-79Dec 9, 2024 | CVSS-v4.0 | EPSS0.327% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2024-11942MEDIUM | Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10. CWE-390Dec 5, 2024 | CVSS5.9v3.1 | EPSS0.375% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-11941HIGH | Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8. CWE-835Dec 5, 2024 | CVSS7.5v3.1 | EPSS0.457% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |