Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Drupal core 10.6.19, 11.3.19 and 2 more versions Clear all filters
TI-2026-82852 CVE-2026-108097 · GHSA-x75q-mvwp-2h36

Reflection injection in Drupal core allows remote code execution

Priority LOW 38

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00572 Published 2026-10-30 Fixed in 10.6.19, 11.3.19 +2 CWE-470
TI-2026-82855 CVE-2026-108515 · GHSA-297f-h4fx-vc6c

Cross-site scripting in Drupal core allows script injection

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00212 Published 2026-10-30 Fixed in 10.6.19, 11.3.19 +2 CWE-79
TI-2026-82854 CVE-2026-108514 · GHSA-8pmv-83q8-mcx5

Cross-site scripting in Drupal core

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00212 Published 2026-10-30 Fixed in 10.6.19, 11.3.19 +2 CWE-79