Vulnerabilities

TI-2026-40289 CVE-2026-55808 · GHSA-9wh5-5mcm-hf2j

Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

LOW 24

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00273 Published 2026-07-10 Fixed in 10.5.12, 10.6.11 +2 CWE-79

TI-2026-40288 CVE-2026-55807 · GHSA-qrwq-jwq3-8cc8

Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

LOW 15

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00221 Published 2026-07-10 Fixed in 10.5.12, 10.6.11 +2 CWE-918

TI-2026-40287 CVE-2026-55806 · GHSA-vwxh-w8pq-6q99

Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

LOW 26

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00339 Published 2026-07-10 Fixed in 10.5.12, 10.6.11 +2 CWE-601

TI-2026-40285 CVE-2026-55804 · GHSA-x7hc-r9m3-67vr

Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

LOW 28

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.

CVSS 3.1MEDIUM 5.9 Network High privileges No interaction EPSS 0.00353 Published 2026-07-10 Fixed in 10.5.12, 10.6.11 +2 CWE-915

TI-2026-40284 CVE-2026-55803 · GHSA-25f6-4hrw-j87c

Drupal core - Critical - PHP object injection - SA-CORE-2026-005