46 matches found
CVE-2026-55807
The Media module in Drupal core contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-55807) stemming from its oEmbed URL discovery code. This flaw could be leveraged to trick the server into making unauthorized requests to arbitrary URLs. Affected versions include 10.5.x prior to...
CVE-2026-55803 Drupal core - Critical - PHP object injection - SA-CORE-2026-005
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.,...
VulnCheck KEV: CVE-2026-9082
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API...
Exploit for CVE-2026-9082
CVE-2026-9082 Type: SQL Injection CWE-89 Affected Pr...
CVE-2026-6365 Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7...
Drupal 10.5.x < 10.5.9 / 10.6.x < 10.6.7 / 11.2.x < 11.2.11 / 11.3.x < 11.3.7 Multiple Vulnerabilities (drupal-2026-04-15)
According to its self-reported version, the instance of Drupal running on the remote web server is 10.5.x prior to 10.5.9, 10.6.x prior to 10.6.7, 11.2.x prior to 11.2.11, or 11.3.x prior to 11.3.7. It is, therefore, affected by multiple vulnerabilities. - Drupal core's jQuery integration for AJA...
CVE-2026-0749 Cross-Site Scripting Vulnerability in Drupal Form Builder Module
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Form Builder allows Cross-Site Scripting XSS.This issue affects Drupal: from 7.X-1.0 through 7.X-1.22...
CVE-2026-0749
Technical details, affected versions, and mitigation are not publicly provided in the supplied documents. Monitor for updates from official advisories and CVE entries.
PT-2026-5189
Name of the Vulnerable Software and Affected Versions Drupal Form Builder versions 7.X-1.0 through 7.X-1.22 Description A flaw exists in Drupal Form Builder that allows for Cross-Site Scripting XSS. This issue is due to improper neutralization of input during web page generation. Successful...
CVE-2025-14557
CVE-2025-14557 affects Drupal Facebook Pixel module (facebook_pixel) with stored XSS due to improper input neutralization during page generation. Affected versions are 7.X-1.0 through 7.X-1.1. The vulnerability can allow malicious script injection via input fields rendered on generated pages, as ...
BIT-DRUPAL-2025-13082 Drupal core - Moderately critical - Defacement - SA-CORE-2025-007
User Interface UI Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8...
BIT-DRUPAL-2025-13081 Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8...
CVE-2025-13082 Drupal core - Moderately critical - Defacement - SA-CORE-2025-007
User Interface UI Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8...
Drupal core 8.0.0-10.4.8,10.5.0-10.5.5,11.0.0-11.1.8,11.2.0-11.2.7 - Unauthenticated Defacement vulnerability
Unauthenticated Defacement vulnerability discovered by Kevin Quillen kevinquillen in WordPress Core Drupal versions 8.0.0-10.4.8,10.5.0-10.5.5,11.0.0-11.1.8,11.2.0-11.2.7...
EUVD-2010-5234
Malware in sbrugna...
EUVD-2005-3968
Malware in sbrugna...
EUVD-2008-3728
Malware in sbrugna...
EUVD-2008-0284
Malware in sbrugna...