VulertSecurity VulertSecurity

Vulnerability Database · Packagist · drupal/core · Version

drupal/core 11.2.0-rc1

11.2.0-rc1 is affected by 16 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 1 High 0 Medium 2 Low 0 Unrated 13

All drupal/core versions & vulnerabilities → Search the database for this package →
Database updated 23/Oct/2026

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

drupal/core 11.2.0-rc1 vulnerabilities

16 vulnerabilities cover drupal/core 11.2.0-rc1. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2011-2715: Drupal SQL Injection vulnerability 9.8 critical No fix published 22 Apr 2022
CVE-2011-2714: Drupal Cross-Site Scripting Vulnerability 6.1 medium No fix published 22 Apr 2022
CVE-2026-108514: Drupal Core Navigation Module XSS Vulnerability N/A unrated 10.6.19 14 Oct 2026
CVE-2026-108515: Drupal Core Link Module XSS Vulnerability N/A unrated 10.6.19 14 Oct 2026
CVE-2026-108097: Drupal Core Field UI Module Remote Code Execution Vulnerability N/A unrated 10.6.19 14 Oct 2026
Critical XSS Vulnerability in CKEditor Used by Drupal Core - Update Required N/A unrated 10.6.17 16 Sep 2026
CVE-2026-55805: Drupal Core Layout Builder Module XSS Vulnerability N/A unrated 10.6.13 15 Jul 2026
CVE-2026-15916: Drupal Core Image Module Access Control Vulnerability N/A unrated 10.6.13 15 Jul 2026
CVE-2026-55807: Drupal Core Media Module oEmbed URL Discovery Vulnerability N/A unrated 10.5.12 17 Jun 2026
CVE-2026-55806: Drupal Core Cache Poisoning Vulnerability in rebuild.php N/A unrated 10.5.12 17 Jun 2026
CVE-2026-55804: Drupal Core Insecure Deserialization Vulnerability N/A unrated 10.5.12 08 Jun 2026
CVE-2026-55803: Drupal Core PHP Object Injection Vulnerability via JSON:API N/A unrated 10.5.12 05 Jun 2026
CVE-2026-55808: Drupal Core Image Upload Vulnerability Leading to Potential XSS N/A unrated 10.5.12 02 Jun 2026
CVE-2026-6366: Drupal Core Insecure Deserialization Vulnerability N/A unrated 10.5.9 15 Apr 2026
CVE-2026-6365: Drupal Core AJAX Modal Dialog XSS Vulnerability N/A unrated 10.5.9 15 Apr 2026
CVE-2024-22362: Drupal Denial of Service vulnerability N/A medium No fix published 16 Jan 2024

Looking for another version, or everything Vulert holds for drupal/core?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About drupal/core 11.2.0-rc1

Is drupal/core 11.2.0-rc1 vulnerable?

Yes. 16 vulnerabilities in the Vulert database cover drupal/core 11.2.0-rc1: 1 critical, 0 high, 2 medium and 0 low, plus 13 not yet rated. Each entry above names the fixed version to move to.

How do I monitor drupal/core for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the drupal/core version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.