drupal/core Security Advisories for 9.4.0-rc2 (24)
-
[CRITICAL] Drupal Core has a SQL Injection issue
PKSA-h76q-q9b2-4kdc CVE-2026-9082 GHSA-ghwc-95x2-682j
Affected version: >=11.3.0,<11.3.10|>=11.2.0,<11.2.12|>=11.0.0,<11.1.10|>=10.6.0,<10.6.9|>=10.5.0,<10.5.10|>=8.9.0,<10.4.10
Reported by:
GitHub -
[MEDIUM] Drupal core is Vulnerable to Cross-Site Scripting
PKSA-7kyj-yy4m-jzhv CVE-2026-6365 GHSA-f3cj-mjqm-fhvj
Affected version: >=11.3.0,<11.3.7|>=11.0.0,<11.2.11|>=10.6.0,<10.6.7|>=8.0.0,<10.5.9
Reported by:
GitHub -
[MEDIUM] Drupal core allows Object Injection
PKSA-j351-xv4b-pryh CVE-2026-6366 GHSA-xmjc-63pr-2mpg
Affected version: >=11.3.0,<11.3.7|>=11.0.0,<11.2.11|>=10.6.0,<10.6.7|>=8.0.0,<10.5.9
Reported by:
GitHub -
[LOW] Drupal core allows Forceful Browsing
PKSA-bn52-vyzy-rmnm CVE-2025-13080 GHSA-83v7-c2cf-p9c2
Affected version: >=11.2.0,<11.2.8|>=11.0.0,<11.1.9|>=10.5.0,<10.5.6|>=8.0.0,<10.4.9
Reported by:
GitHub -
[MEDIUM] Drupal core allows Object Injection
PKSA-xj83-g6g8-41vf CVE-2025-13081 GHSA-m6vv-vcj8-w8m7
Affected version: >=11.2.0,<11.2.8|>=11.0.0,<11.1.9|>=10.5.0,<10.5.6|>=8.0.0,<10.4.9
Reported by:
GitHub -
[LOW] Drupal core allows Content Spoofing
PKSA-dh1f-zjm5-qg8y CVE-2025-13082 GHSA-h89p-5896-f4q8
Affected version: >=11.2.0,<11.2.8|>=11.0.0,<11.1.9|>=10.5.0,<10.5.6|>=8.0.0,<10.4.9
Reported by:
GitHub -
[LOW] Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
PKSA-d8tb-wwz2-ctxk CVE-2025-13083 GHSA-mhpg-hpj5-73r2
Affected version: >=7.0,<7.103|>=11.2.0,<11.2.8|>=11.0.0,<11.1.9|>=10.5.0,<10.5.6|>=8.0.0,<10.4.9
Reported by:
GitHub -
[MEDIUM] Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages
PKSA-s1zc-gcfk-ddw5 CVE-2025-3057 GHSA-39g6-x4x8-5jcm
Affected version: >=11.1.0,<11.1.3|>=11.0.0,<11.0.12|>=10.4.0,<10.4.3|>=8.0.0,<10.3.13
Reported by:
GitHub -
[MEDIUM] Drupal Core Vulnerable to Forceful Browsing
PKSA-s6zc-mws4-ngh4 CVE-2025-31673 GHSA-wpp8-fjgf-pwc7
Affected version: >=11.1.0,<11.1.3|>=11.0.0,<11.0.12|>=10.4.0,<10.4.3|>=8.0.0,<10.3.13
Reported by:
GitHub -
[MEDIUM] Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability
PKSA-ctyc-dmct-npkz CVE-2025-31674 GHSA-2qph-q8xw-gv7q
Affected version: >=11.1.0,<11.1.3|>=11.0.0,<11.0.12|>=10.4.0,<10.4.3|>=8.0.0,<10.3.13
Reported by:
GitHub -
[LOW] Drupal Core Cross-Site Scripting (XSS) Vulnerability
PKSA-42zc-x5ss-z64p CVE-2025-31675 GHSA-m4wj-hhwj-47qp
Affected version: >=11.1.0,<11.1.5|>=11.0.0,<11.0.13|>=10.4.0,<10.4.5|>=8.0.0,<10.3.14
Reported by:
GitHub -
[MEDIUM] Drupal core Access bypass
PKSA-ts55-c66h-g96n CVE-2024-55634 GHSA-7cwc-fjqm-8vh8
Affected version: >=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.0.0,<10.2.11
Reported by:
GitHub -
[LOW] Drupal core contains a potential PHP Object Injection vulnerability
PKSA-jthw-vxjy-kxnx CVE-2024-55636 GHSA-938f-5r4f-h65v
Affected version: >=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.8.0,<10.2.11
Reported by:
GitHub -
[HIGH] Drupal core contains a potential PHP Object Injection vulnerability
PKSA-g51h-n1x3-mszr CVE-2024-55637 GHSA-w6rx-9g2x-mg5g
Affected version: >=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.8.0,<10.2.11
Reported by:
GitHub -
[HIGH] Drupal core contains a potential PHP Object Injection vulnerability
PKSA-xd2s-f2mt-7tf3 CVE-2024-55638 GHSA-gvf2-2f4g-jqf4
Affected version: >=7.0,<7.102|>=10.3.0,<10.3.9|>=8.8.0,<10.2.11
Reported by:
GitHub -
[MEDIUM] Drupal Core Cross-Site Scripting (XSS)
PKSA-yjvc-rnsz-8n3c CVE-2024-12393 GHSA-8mvq-8h2v-j9vf
Affected version: >=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.8.0,<10.2.11
Reported by:
GitHub -
[MEDIUM] Drupal Full Path Disclosure
PKSA-styk-3knc-d1bt CVE-2024-45440 GHSA-mg8j-w93w-xjgc
Affected version: >=8.0.0,<10.2.9|>=10.3.0,<10.3.6|>=11.0.0,<11.0.5
Reported by:
GitHub -
[MEDIUM] Drupal core - Moderately critical - Denial of Service
PKSA-2gfj-5sh8-j3c5 GHSA-f84q-mgj9-8jfc
Affected version: >=8.0.0,<8.1.0|>=8.1.0,<8.2.0|>=8.2.0,<8.3.0|>=8.3.0,<8.4.0|>=8.4.0,<8.5.0|>=8.5.0,<8.6.0|>=8.6.0,<8.7.0|>=8.7.0,<8.8.0|>=8.8.0,<8.9.0|>=8.9.0,<9.0.0|>=9.0.0,<9.1.0|>=9.1.0,<9.2.0|>=9.2.0,<9.3.0|>=9.3.0,<9.4.0|>=9.4.0,<9.5.0|>=9.5.0,<10.0.0|>=10.0.0,<10.1.0|>=10.1.0,<10.1.8|>=10.2.0,<10.2.2
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[CRITICAL] Cache poisoning in drupal/core
PKSA-my7h-svxh-5q3g CVE-2023-5256 GHSA-rjqg-3h9m-fx5x
Affected version: >=10.1.0,<10.1.4|>=10.0.0,<10.0.11|>=8.7.0,<9.5.11
Reported by:
GitHub -
[CRITICAL] Access bypass in Drupal core
PKSA-h7d4-5mdz-2965 CVE-2023-31250 GHSA-8849-cv9f-vccm
Affected version: >=7.0.0,<7.96|>=9.0.0,<9.4.14|>=9.5.0,<9.5.8|>=10.0.0,<10.0.8
Reported by:
GitHub -
[MEDIUM] Lack of domain validation in Druple core
PKSA-4j5n-cxxv-ptjc CVE-2022-25276 GHSA-4wfq-jc9h-vpcx
Affected version: >=9.4.0,<9.4.3|>=8.0.0,<9.3.19
Reported by:
GitHub -
[HIGH] Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012
PKSA-hy6y-p19f-b5kf CVE-2022-25275 GHSA-xh3v-6f9j-wxw3
Affected version: >=7.0.0,<7.91.0|>=8.9.0,<8.10.0|>=9.0.0,<9.1.0|>=9.1.0,<9.2.0|>=9.2.0,<9.3.0|>=9.3.0,<9.3.19|>=9.4.0,<9.4.3
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[HIGH] Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2022-014
PKSA-7q72-qds7-4xyv CVE-2022-25277 GHSA-6955-67hm-vjjq
Affected version: >=8.9.0,<8.10.0|>=9.0.0,<9.1.0|>=9.1.0,<9.2.0|>=9.2.0,<9.3.0|>=9.3.0,<9.3.19|>=9.4.0,<9.4.3
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[MEDIUM] Drupal core - Moderately critical - Access Bypass - SA-CORE-2022-013
PKSA-gkkw-qh7h-5181 CVE-2022-25278 GHSA-cfh2-7f6h-3m85
Affected version: >=8.0.0,<9.3.19|>=9.4.0,<9.4.3
Reported by:
FriendsOfPHP/security-advisories, GitHub