CVE-2026-55807

A Server-Side Request Forgery (SSRF) vulnerability exists in the Drupal core Media module. The issue is caused by the oEmbed URL discovery code, which can be leveraged to trick Drupal into making server-side requests to arbitrary URLs. This vulnerability affects Drupal core versions: 10.5.x < ...