Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Drupal core 10.5.9, 10.6.7 and 2 more versions Clear all filters
TI-2026-05585 CVE-2026-6366 · GHSA-xmjc-63pr-2mpg

Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

Priority LOW 31

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00399 Published 2026-05-19 Fixed in 10.5.9, 10.6.7 +2 CWE-915
TI-2026-05584 CVE-2026-6365 · GHSA-f3cj-mjqm-fhvj

Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001

Priority LOW 27

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00219 Published 2026-05-19 Fixed in 10.5.9, 10.6.7 +2 CWE-79