VulertSecurity VulertSecurity

Vulnerability Database · Search

drupal/core vulnerabilities — 193 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →
Severity Vulnerability Package Ecosystem Disclosed Fixed version
Unrated CVE-2026-108514: Drupal Core Navigation Module XSS Vulnerability drupal/core Packagist 14 Oct 2026 10.6.19
Unrated CVE-2026-108515: Drupal Core Link Module XSS Vulnerability drupal/core Packagist 14 Oct 2026 10.6.19
Unrated CVE-2026-108097: Drupal Core Field UI Module Remote Code Execution Vulnerability drupal/core Packagist 14 Oct 2026 10.6.19
Unrated Critical XSS Vulnerability in CKEditor Used by Drupal Core - Update Required drupal/core Packagist 16 Sep 2026 10.6.17
Unrated CVE-2026-55805: Drupal Core Layout Builder Module XSS Vulnerability drupal/core Packagist 15 Jul 2026 10.6.13
Unrated CVE-2026-15917: Drupal Core XSS Vulnerability in HTMX Integration drupal/core Packagist 15 Jul 2026 11.3.14
Unrated CVE-2026-15916: Drupal Core Image Module Access Control Vulnerability drupal/core Packagist 15 Jul 2026 10.6.13
Unrated CVE-2026-55807: Drupal Core Media Module oEmbed URL Discovery Vulnerability drupal/core Packagist 17 Jun 2026 10.5.12
Unrated CVE-2026-55806: Drupal Core Cache Poisoning Vulnerability in rebuild.php drupal/core Packagist 17 Jun 2026 10.5.12
Unrated CVE-2026-55804: Drupal Core Insecure Deserialization Vulnerability drupal/core Packagist 08 Jun 2026 10.5.12
Unrated CVE-2026-55803: Drupal Core PHP Object Injection Vulnerability via JSON:API drupal/core Packagist 05 Jun 2026 10.5.12
Unrated CVE-2026-55808: Drupal Core Image Upload Vulnerability Leading to Potential XSS drupal/core Packagist 02 Jun 2026 10.5.12
9.8 critical CVE-2026-9082: Drupal Core SQL Injection Vulnerability drupal/core Packagist 20 May 2026 10.4.10
Unrated CVE-2026-9082: Drupal Core SQL Injection Vulnerability in PostgreSQL Databases drupal/core Packagist 20 May 2026 10.4.10
6.6 medium CVE-2026-6366: Drupal Core Object Injection Vulnerability drupal/core Packagist 20 May 2026 10.5.9
6.1 medium CVE-2026-6365: Drupal Core Cross-Site Scripting Vulnerability drupal/core Packagist 20 May 2026 10.5.9
6.1 medium CVE-2026-6367: Drupal Core Cross-Site Scripting (XSS) Vulnerability drupal/core Packagist 20 May 2026 11.3.7
Unrated CVE-2026-6367: Drupal Core 11.3 Cross-Site Scripting Vulnerability in CKEditor 5 Link Suggestions drupal/core Packagist 15 Apr 2026 11.3.7
Unrated CVE-2026-6366: Drupal Core Insecure Deserialization Vulnerability drupal/core Packagist 15 Apr 2026 10.5.9
Unrated CVE-2026-6365: Drupal Core AJAX Modal Dialog XSS Vulnerability drupal/core Packagist 15 Apr 2026 10.5.9
Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.