VulertSecurity VulertSecurity

Vulnerability Database · Packagist · drupal/core · Version

drupal/core 10.2.11

10.2.11 is affected by 34 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 2 High 0 Medium 8 Low 4 Unrated 20

All drupal/core versions & vulnerabilities → Search the database for this package →
Database updated 23/Oct/2026

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

drupal/core 10.2.11 vulnerabilities

34 vulnerabilities cover drupal/core 10.2.11. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-9082: Drupal Core SQL Injection Vulnerability 9.8 critical 10.4.10 20 May 2026
CVE-2011-2715: Drupal SQL Injection vulnerability 9.8 critical No fix published 22 Apr 2022
CVE-2026-6366: Drupal Core Object Injection Vulnerability 6.6 medium 10.5.9 20 May 2026
CVE-2026-6365: Drupal Core Cross-Site Scripting Vulnerability 6.1 medium 10.5.9 20 May 2026
CVE-2025-3057: Drupal Core Cross-Site Scripting (XSS) Vulnerability in Error Messages 6.1 medium 10.3.13 01 Apr 2025
CVE-2011-2714: Drupal Cross-Site Scripting Vulnerability 6.1 medium No fix published 22 Apr 2022
CVE-2025-13081: Drupal Core Object Injection Vulnerability 5.9 medium 10.4.9 18 Nov 2025
CVE-2025-31675: Drupal Core Cross-Site Scripting (XSS) Vulnerability 5.4 low 10.3.14 01 Apr 2025
CVE-2025-31673: Drupal Core Forceful Browsing Vulnerability 4.6 medium 10.3.13 01 Apr 2025
CVE-2025-31674: Drupal Core Object Injection Vulnerability 4.5 medium 10.3.13 01 Apr 2025
CVE-2025-13083: Drupal Core Access Control Misconfiguration Vulnerability 3.7 low 10.4.9 18 Nov 2025
CVE-2025-13080: Drupal Core Forceful Browsing Vulnerability 2.7 low 10.4.9 18 Nov 2025
CVE-2025-13082: Drupal Core Content Spoofing Vulnerability 2.1 low 10.4.9 18 Nov 2025
CVE-2026-108515: Drupal Core Link Module XSS Vulnerability N/A unrated 10.6.19 14 Oct 2026
CVE-2026-108097: Drupal Core Field UI Module Remote Code Execution Vulnerability N/A unrated 10.6.19 14 Oct 2026
CVE-2026-55805: Drupal Core Layout Builder Module XSS Vulnerability N/A unrated 10.6.13 15 Jul 2026
CVE-2026-15916: Drupal Core Image Module Access Control Vulnerability N/A unrated 10.6.13 15 Jul 2026
CVE-2026-55807: Drupal Core Media Module oEmbed URL Discovery Vulnerability N/A unrated 10.5.12 17 Jun 2026
CVE-2026-55806: Drupal Core Cache Poisoning Vulnerability in rebuild.php N/A unrated 10.5.12 17 Jun 2026
CVE-2026-55804: Drupal Core Insecure Deserialization Vulnerability N/A unrated 10.5.12 08 Jun 2026
CVE-2026-55803: Drupal Core PHP Object Injection Vulnerability via JSON:API N/A unrated 10.5.12 05 Jun 2026
CVE-2026-55808: Drupal Core Image Upload Vulnerability Leading to Potential XSS N/A unrated 10.5.12 02 Jun 2026
CVE-2026-9082: Drupal Core SQL Injection Vulnerability in PostgreSQL Databases N/A unrated 10.4.10 20 May 2026
CVE-2026-6366: Drupal Core Insecure Deserialization Vulnerability N/A unrated 10.5.9 15 Apr 2026
CVE-2026-6365: Drupal Core AJAX Modal Dialog XSS Vulnerability N/A unrated 10.5.9 15 Apr 2026
Cache-Control Misconfiguration in Drupal Core: Potential Exposure of Private Files N/A unrated 10.4.9 12 Nov 2025
CVE-2025-13082: Drupal Core Site Defacement Vulnerability N/A unrated 10.4.9 12 Nov 2025
Insecure Deserialization Vulnerability in Drupal Core: Remote Code Execution Risk N/A unrated 10.4.9 12 Nov 2025
CVE-2025-13080: Drupal Core Cache Poisoning Vulnerability N/A unrated 10.4.9 12 Nov 2025
Cross Site Scripting Vulnerability in Drupal Core Link Field Attributes N/A unrated 10.3.14 19 Mar 2025
PHP Object Injection Vulnerability in Drupal Core: Risk of Arbitrary File Inclusion N/A unrated 10.3.13 19 Feb 2025
Drupal Core Bulk Operations Vulnerability - Unauthorized Field Modification Risk N/A unrated 10.3.13 19 Feb 2025
CVE-2025-3057: Drupal Core Reflected XSS Vulnerability Due to Insufficient Error Message Filtering N/A unrated 10.3.13 19 Feb 2025
CVE-2024-22362: Drupal Denial of Service vulnerability N/A medium No fix published 16 Jan 2024

Looking for another version, or everything Vulert holds for drupal/core?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About drupal/core 10.2.11

Is drupal/core 10.2.11 vulnerable?

Yes. 34 vulnerabilities in the Vulert database cover drupal/core 10.2.11: 2 critical, 0 high, 8 medium and 4 low, plus 20 not yet rated. Each entry above names the fixed version to move to.

How do I monitor drupal/core for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the drupal/core version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.