VulertSecurity VulertSecurity

Vulnerability Database · Packagist · drupal/core · Version

drupal/core 11.0.11

11.0.11 is affected by 25 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 1 High 0 Medium 2 Low 0 Unrated 22

All drupal/core versions & vulnerabilities → Search the database for this package →
Database updated 23/Oct/2026

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

drupal/core 11.0.11 vulnerabilities

25 vulnerabilities cover drupal/core 11.0.11. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2011-2715: Drupal SQL Injection vulnerability 9.8 critical No fix published 22 Apr 2022
CVE-2011-2714: Drupal Cross-Site Scripting Vulnerability 6.1 medium No fix published 22 Apr 2022
CVE-2026-108514: Drupal Core Navigation Module XSS Vulnerability N/A unrated 10.6.19 14 Oct 2026
CVE-2026-108515: Drupal Core Link Module XSS Vulnerability N/A unrated 10.6.19 14 Oct 2026
CVE-2026-108097: Drupal Core Field UI Module Remote Code Execution Vulnerability N/A unrated 10.6.19 14 Oct 2026
Critical XSS Vulnerability in CKEditor Used by Drupal Core - Update Required N/A unrated 10.6.17 16 Sep 2026
CVE-2026-55805: Drupal Core Layout Builder Module XSS Vulnerability N/A unrated 10.6.13 15 Jul 2026
CVE-2026-15916: Drupal Core Image Module Access Control Vulnerability N/A unrated 10.6.13 15 Jul 2026
CVE-2026-55807: Drupal Core Media Module oEmbed URL Discovery Vulnerability N/A unrated 10.5.12 17 Jun 2026
CVE-2026-55806: Drupal Core Cache Poisoning Vulnerability in rebuild.php N/A unrated 10.5.12 17 Jun 2026
CVE-2026-55804: Drupal Core Insecure Deserialization Vulnerability N/A unrated 10.5.12 08 Jun 2026
CVE-2026-55803: Drupal Core PHP Object Injection Vulnerability via JSON:API N/A unrated 10.5.12 05 Jun 2026
CVE-2026-55808: Drupal Core Image Upload Vulnerability Leading to Potential XSS N/A unrated 10.5.12 02 Jun 2026
CVE-2026-9082: Drupal Core SQL Injection Vulnerability in PostgreSQL Databases N/A unrated 10.4.10 20 May 2026
CVE-2026-6366: Drupal Core Insecure Deserialization Vulnerability N/A unrated 10.5.9 15 Apr 2026
CVE-2026-6365: Drupal Core AJAX Modal Dialog XSS Vulnerability N/A unrated 10.5.9 15 Apr 2026
Cache-Control Misconfiguration in Drupal Core: Potential Exposure of Private Files N/A unrated 10.4.9 12 Nov 2025
CVE-2025-13082: Drupal Core Site Defacement Vulnerability N/A unrated 10.4.9 12 Nov 2025
Insecure Deserialization Vulnerability in Drupal Core: Remote Code Execution Risk N/A unrated 10.4.9 12 Nov 2025
CVE-2025-13080: Drupal Core Cache Poisoning Vulnerability N/A unrated 10.4.9 12 Nov 2025
Cross Site Scripting Vulnerability in Drupal Core Link Field Attributes N/A unrated 10.3.14 19 Mar 2025
PHP Object Injection Vulnerability in Drupal Core: Risk of Arbitrary File Inclusion N/A unrated 10.3.13 19 Feb 2025
Drupal Core Bulk Operations Vulnerability - Unauthorized Field Modification Risk N/A unrated 10.3.13 19 Feb 2025
CVE-2025-3057: Drupal Core Reflected XSS Vulnerability Due to Insufficient Error Message Filtering N/A unrated 10.3.13 19 Feb 2025
CVE-2024-22362: Drupal Denial of Service vulnerability N/A medium No fix published 16 Jan 2024

Looking for another version, or everything Vulert holds for drupal/core?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About drupal/core 11.0.11

Is drupal/core 11.0.11 vulnerable?

Yes. 25 vulnerabilities in the Vulert database cover drupal/core 11.0.11: 1 critical, 0 high, 2 medium and 0 low, plus 22 not yet rated. Each entry above names the fixed version to move to.

How do I monitor drupal/core for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the drupal/core version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.