PHP package security
Is drupal/core vulnerable?
112 known security advisories for drupal/core. The latest was reported on 2026-05-20 and is fixed in 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12 and 11.3.10. The newest release, 11.4.11, is not affected by any of them.
15 critical 33 high 58 medium 5 low 1 unscored
- Known advisories
- 112
- Newest release
- 11.4.11
- Released
- 2026-10-21
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for drupal/core
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-05-20 | Drupal Core has a SQL Injection issue GHSA-ghwc-95x2-682j · CVE-2026-9082 · GitHub | critical | >=11.3.0,<11.3.10 | >=11.2.0,<11.2.12 | >=11.0.0,<11.1.10 | >=10.6.0,<10.6.9 | >=10.5.0,<10.5.10 | >=8.9.0,<10.4.10 | 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10 |
| 2026-05-20 | Drupal core allows Object Injection GHSA-xmjc-63pr-2mpg · CVE-2026-6366 · GitHub | medium | >=11.3.0,<11.3.7 | >=11.0.0,<11.2.11 | >=10.6.0,<10.6.7 | >=8.0.0,<10.5.9 | 10.5.9, 10.6.7, 11.2.11, 11.3.7 |
| 2026-05-20 | Drupal core is Vulnerable to Cross-Site Scripting GHSA-f3cj-mjqm-fhvj · CVE-2026-6365 · GitHub | medium | >=11.3.0,<11.3.7 | >=11.0.0,<11.2.11 | >=10.6.0,<10.6.7 | >=8.0.0,<10.5.9 | 10.5.9, 10.6.7, 11.2.11, 11.3.7 |
| 2026-05-20 | Drupal core allows Cross-Site Scripting (XSS) GHSA-pw6f-3999-xp7g · CVE-2026-6367 · GitHub | medium | >=11.3.0,<11.3.7 | 11.3.7 |
| 2025-11-18 | Drupal core allows Object Injection GHSA-m6vv-vcj8-w8m7 · CVE-2025-13081 · GitHub | medium | >=11.2.0,<11.2.8 | >=11.0.0,<11.1.9 | >=10.5.0,<10.5.6 | >=8.0.0,<10.4.9 | 10.4.9, 10.5.6, 11.1.9, 11.2.8 |
| 2025-11-18 | Drupal core allows Content Spoofing GHSA-h89p-5896-f4q8 · CVE-2025-13082 · GitHub | low | >=11.2.0,<11.2.8 | >=11.0.0,<11.1.9 | >=10.5.0,<10.5.6 | >=8.0.0,<10.4.9 | 10.4.9, 10.5.6, 11.1.9, 11.2.8 |
| 2025-11-18 | Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels GHSA-mhpg-hpj5-73r2 · CVE-2025-13083 · GitHub | low | >=7.0,<7.103 | >=11.2.0,<11.2.8 | >=11.0.0,<11.1.9 | >=10.5.0,<10.5.6 | >=8.0.0,<10.4.9 | 7.103, 10.4.9, 10.5.6, 11.1.9, 11.2.8 |
| 2025-11-18 | Drupal core allows Forceful Browsing GHSA-83v7-c2cf-p9c2 · CVE-2025-13080 · GitHub | low | >=11.2.0,<11.2.8 | >=11.0.0,<11.1.9 | >=10.5.0,<10.5.6 | >=8.0.0,<10.4.9 | 10.4.9, 10.5.6, 11.1.9, 11.2.8 |
| 2025-04-01 | Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages GHSA-39g6-x4x8-5jcm · CVE-2025-3057 · GitHub | medium | >=11.1.0,<11.1.3 | >=11.0.0,<11.0.12 | >=10.4.0,<10.4.3 | >=8.0.0,<10.3.13 | 10.3.13, 10.4.3, 11.0.12, 11.1.3 |
| 2025-04-01 | Drupal Core Vulnerable to Forceful Browsing GHSA-wpp8-fjgf-pwc7 · CVE-2025-31673 · GitHub | medium | >=11.1.0,<11.1.3 | >=11.0.0,<11.0.12 | >=10.4.0,<10.4.3 | >=8.0.0,<10.3.13 | 10.3.13, 10.4.3, 11.0.12, 11.1.3 |
| 2025-04-01 | Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability GHSA-2qph-q8xw-gv7q · CVE-2025-31674 · GitHub | medium | >=11.1.0,<11.1.3 | >=11.0.0,<11.0.12 | >=10.4.0,<10.4.3 | >=8.0.0,<10.3.13 | 10.3.13, 10.4.3, 11.0.12, 11.1.3 |
| 2025-04-01 | Drupal Core Cross-Site Scripting (XSS) Vulnerability GHSA-m4wj-hhwj-47qp · CVE-2025-31675 · GitHub | low | >=11.1.0,<11.1.5 | >=11.0.0,<11.0.13 | >=10.4.0,<10.4.5 | >=8.0.0,<10.3.14 | 10.3.14, 10.4.5, 11.0.13, 11.1.5 |
| 2024-12-10 | Drupal core contains a potential PHP Object Injection vulnerability GHSA-gvf2-2f4g-jqf4 · CVE-2024-55638 · GitHub | high | >=7.0,<7.102 | >=10.3.0,<10.3.9 | >=8.8.0,<10.2.11 | 7.102, 10.2.11, 10.3.9 |
| 2024-12-10 | Drupal core Access bypass GHSA-7cwc-fjqm-8vh8 · CVE-2024-55634 · GitHub | medium | >=11.0.0,<11.0.8 | >=10.3.0,<10.3.9 | >=8.0.0,<10.2.11 | 10.2.11, 10.3.9, 11.0.8 |
| 2024-12-10 | Drupal core contains a potential PHP Object Injection vulnerability GHSA-938f-5r4f-h65v · CVE-2024-55636 · GitHub | low | >=11.0.0,<11.0.8 | >=10.3.0,<10.3.9 | >=8.8.0,<10.2.11 | 10.2.11, 10.3.9, 11.0.8 |
| 2024-12-10 | Drupal core contains a potential PHP Object Injection vulnerability GHSA-w6rx-9g2x-mg5g · CVE-2024-55637 · GitHub | high | >=11.0.0,<11.0.8 | >=10.3.0,<10.3.9 | >=8.8.0,<10.2.11 | 10.2.11, 10.3.9, 11.0.8 |
| 2024-12-10 | Drupal Core Cross-Site Scripting (XSS) GHSA-8mvq-8h2v-j9vf · CVE-2024-12393 · GitHub | medium | >=11.0.0,<11.0.8 | >=10.3.0,<10.3.9 | >=8.8.0,<10.2.11 | 10.2.11, 10.3.9, 11.0.8 |
| 2024-12-05 | Drupal core Denial of Service GHSA-xq54-x54m-vcpx · CVE-2024-11941 · GitHub | high | >=10.2.0,<10.2.2 | >=10.1.0,<10.1.8 | 10.1.8, 10.2.2 |
| 2024-12-05 | Drupal core vulnerable to improper error handling GHSA-52jr-x6h6-xj6g · CVE-2024-11942 · GitHub | medium | >=10.0.0,<10.2.10 | 10.2.10 |
| 2024-08-29 | Drupal Full Path Disclosure GHSA-mg8j-w93w-xjgc · CVE-2024-45440 · GitHub | medium | >=8.0.0,<10.2.9 | >=10.3.0,<10.3.6 | >=11.0.0,<11.0.5 | 10.2.9, 10.3.6, 11.0.5 |
| 2024-01-17 | Drupal core - Moderately critical - Denial of Service Advisory · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.8.0 | >=8.8.0,<8.9.0 | >=8.9.0,<9.0.0 | >=9.0.0,<9.1.0 | >=9.1.0,<9.2.0 | >=9.2.0,<9.3.0 | >=9.3.0,<9.4.0 | >=9.4.0,<9.5.0 | >=9.5.0,<10.0.0 | >=10.0.0,<10.1.0 | >=10.1.0,<10.1.8 | >=10.2.0,<10.2.2 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.9.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 10.0.0, 10.1.0, 10.1.8, 10.2.2 |
| 2024-01-16 | Drupal Denial of Service vulnerability GHSA-62cf-jvpp-48q6 · CVE-2024-22362 · GitHub | medium | =9.3.6 | not stated |
| 2023-09-28 | Cache poisoning in drupal/core GHSA-rjqg-3h9m-fx5x · CVE-2023-5256 · GitHub | critical | >=10.1.0,<10.1.4 | >=10.0.0,<10.0.11 | >=8.7.0,<9.5.11 | 9.5.11, 10.0.11, 10.1.4 |
| 2023-04-26 | Access bypass in Drupal core GHSA-8849-cv9f-vccm · CVE-2023-31250 · GitHub | critical | >=7.0.0,<7.96 | >=9.0.0,<9.4.14 | >=9.5.0,<9.5.8 | >=10.0.0,<10.0.8 | 7.96, 9.4.14, 9.5.8, 10.0.8 |
| 2023-04-26 | Access bypass in Drupal core GHSA-7jr4-hgqx-vwgq · CVE-2022-25274 · GitHub | medium | >=9.3.0,<9.3.12 | 9.3.12 |
| 2023-04-26 | Improper input validation in Drupal core GHSA-g36h-4jr6-qmm9 · CVE-2022-25273 · GitHub | high | >=9.3.0,<9.3.12 | >=8.0.0,<9.2.18 | 9.2.18, 9.3.12 |
| 2023-04-26 | Lack of domain validation in Druple core GHSA-4wfq-jc9h-vpcx · CVE-2022-25276 · GitHub | medium | >=9.4.0,<9.4.3 | >=8.0.0,<9.3.19 | 9.3.19, 9.4.3 |
| 2022-07-20 | Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012 CVE-2022-25275 · FriendsOfPHP/security-advisories, GitHub | high | >=7.0.0,<7.91.0 | >=8.9.0,<8.10.0 | >=9.0.0,<9.1.0 | >=9.1.0,<9.2.0 | >=9.2.0,<9.3.0 | >=9.3.0,<9.3.19 | >=9.4.0,<9.4.3 | 7.91.0, 8.10.0, 9.1.0, 9.2.0, 9.3.0, 9.3.19, 9.4.3 |
| 2022-07-20 | Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2022-014 CVE-2022-25277 · FriendsOfPHP/security-advisories, GitHub | high | >=8.9.0,<8.10.0 | >=9.0.0,<9.1.0 | >=9.1.0,<9.2.0 | >=9.2.0,<9.3.0 | >=9.3.0,<9.3.19 | >=9.4.0,<9.4.3 | 8.10.0, 9.1.0, 9.2.0, 9.3.0, 9.3.19, 9.4.3 |
| 2022-07-20 | Drupal core - Moderately critical - Access Bypass - SA-CORE-2022-013 CVE-2022-25278 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0.0,<9.3.19 | >=9.4.0,<9.4.3 | 9.3.19, 9.4.3 |
| 2022-05-24 | Drupal Core Cross-site scripting vulnerability GHSA-qf2g-mrrx-rr5p · CVE-2020-13688 · GitHub | medium | >=9.0.0,<9.0.6 | >=8.9.0,<8.9.6 | >=8.8.0,<8.8.10 | 8.8.10, 8.9.6, 9.0.6 |
| 2022-05-17 | Drupal Access Control Bypass GHSA-96vx-qf28-6f8m · CVE-2011-2687 · GitHub | high | >=7.0,<7.3 | 7.3 |
| 2022-05-17 | Drupal Open Redirect GHSA-66gr-xrcf-8jpq · CVE-2016-9451 · GitHub | medium | >=8.0,<8.2.3 | >=7.0,<7.52 | 7.52, 8.2.3 |
| 2022-04-22 | Drupal Cross-Site Scripting vulnerability GHSA-qp8q-gwf5-hqh2 · CVE-2011-2714 · GitHub | medium | =6.20 | not stated |
| 2022-04-22 | Drupal SQL Injection vulnerability GHSA-hcq9-hmgf-6qr9 · CVE-2011-2715 · GitHub | critical | =6.20 | not stated |
| 2022-02-18 | Improper input validation in Drupal core GHSA-fmfv-x8mp-5767 · CVE-2022-25271 · GitHub | high | >=7.0.0,<7.88 | >=8.0.0,<9.2.13 | >=9.3.0,<9.3.6 | 7.88, 9.2.13, 9.3.6 |
| 2022-02-18 | Incorrect authorization in Drupal core GHSA-73q4-j324-2qcc · CVE-2022-25270 · GitHub | medium | >=8.0.0,<9.2.13 | >=9.3.0,<9.3.6 | 9.2.13, 9.3.6 |
| 2022-02-12 | Cross-Site Request Forgery in Drupal core GHSA-j586-cj67-vg4p · CVE-2020-13674 · GitHub | medium | >=8.0.0,<8.9.19 | >=9.2.0,<9.2.6 | >=9.1.0,<9.1.13 | 8.9.19, 9.1.13, 9.2.6 |
| 2022-02-12 | Unrestricted Upload of File with Dangerous Type in Drupal core GHSA-v8wr-r69p-mmwx · CVE-2020-13675 · GitHub | critical | >=8.0.0,<8.9.19 | >=9.2.0,<9.2.6 | >=9.1.0,<9.1.13 | 8.9.19, 9.1.13, 9.2.6 |
| 2022-02-12 | Incorrect Authorization in Drupal core GHSA-qfhg-m6r8-xxpj · CVE-2020-13676 · GitHub | medium | >=8.0.0,<8.9.19 | >=9.2.0,<9.2.6 | >=9.1.0,<9.1.13 | 8.9.19, 9.1.13, 9.2.6 |
| 2022-02-12 | Drupal core access bypass vulnerability GHSA-3xr3-phjp-g6p2 · CVE-2020-13677 · GitHub | high | >=9.2.0,<9.2.6 | >=9.1.0,<9.1.13 | >=8.0.0,<8.9.19 | 8.9.19, 9.1.13, 9.2.6 |
| 2021-05-26 | Drupal core - Moderately critical - Third-party libraries - SA-CORE-2021-005 Advisory · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.8.0 | >=8.8.0,<8.9.0 | >=8.9.0,<8.9.16 | >=9.0.0,<9.1.0 | >=9.1.0,<9.1.12 | >=9.2.0,<9.2.4 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.9.0, 8.9.16, 9.1.0, 9.1.12, 9.2.4 |
| 2021-04-21 | Drupal core - Critical - Cross-site scripting - SA-CORE-2021-003 CVE-2021-33829 · FriendsOfPHP/security-advisories, GitHub | medium | >=7.0.0,<7.80 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.8.0 | >=8.8.0,<8.9.0 | >=8.9.0,<8.9.16 | >=9.0.0,<9.0.14 | >=9.1.0,<9.1.9 | 7.80, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.9.0, 8.9.16, 9.0.14, 9.1.9 |
| 2021-04-21 | Drupal core - Critical - Cross-site scripting - SA-CORE-2021-002 CVE-2020-13672 · FriendsOfPHP/security-advisories, GitHub | medium | >=7.0.0,<7.80 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.8.0 | >=8.8.0,<8.9.0 | >=8.9.0,<8.9.14 | >=9.0.0,<9.0.12 | >=9.1.0,<9.1.7 | 7.80, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.9.0, 8.9.14, 9.0.12, 9.1.7 |
| 2020-11-25 | Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-013 Advisory · FriendsOfPHP/security-advisories, GitHub | medium | >=7.0.0,<7.74 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.8.0 | >=8.8.0,<8.8.11 | >=8.9.0,<8.9.9 | >=9.0.0,<9.0.8 | 7.74, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.8.11, 8.9.9, 9.0.8 |
| 2020-11-18 | Drupal core - Critical - Remote code execution - SA-CORE-2020-012 CVE-2020-13671 · FriendsOfPHP/security-advisories, GitHub | high | >=7.0.0,<7.74 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.8.0 | >=8.8.0,<8.8.11 | >=8.9.0,<8.9.9 | >=9.0.0,<9.0.8 | 7.74, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.8.11, 8.9.9, 9.0.8 |
| 2020-09-16 | Drupal core - Moderately critical - Access bypass - SA-CORE-2020-008 CVE-2020-13667 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.8.0 | >=8.8.0,<8.8.10 | >=8.9.0,<8.9.6 | >=9.0.0,<9.0.6 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.8.10, 8.9.6, 9.0.6 |
| 2020-09-16 | Drupal core - Moderately critical - Information disclosure - SA-CORE-2020-011 CVE-2020-13670 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.8.0 | >=8.8.0,<8.8.10 | >=8.9.0,<8.9.6 | >=9.0.0,<9.0.6 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.8.10, 8.9.6, 9.0.6 |
| 2020-09-16 | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-007 CVE-2020-13666 · FriendsOfPHP/security-advisories, GitHub | medium | >=7.0.0,<7.73 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.8.0 | >=8.8.0,<8.8.10 | >=8.9.0,<8.9.6 | >=9.0.0,<9.0.6 | 7.73, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.8.10, 8.9.6, 9.0.6 |
| 2020-09-16 | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-010 CVE-2020-13669 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.8.0 | >=8.8.0,<8.8.10 | >=8.9.0,<8.9.6 | >=9.0.0,<9.0.6 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.8.10, 8.9.6, 9.0.6 |
| 2020-09-16 | Drupal core - Critical - Cross-site scripting - SA-CORE-2020-009 CVE-2020-13668 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.8.0 | >=8.8.0,<8.8.10 | >=8.9.0,<8.9.6 | >=9.0.0,<9.0.6 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.8.10, 8.9.6, 9.0.6 |
| 2020-06-17 | Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-005 CVE-2020-13664 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.8.0 | >=8.8.0,<8.8.8 | >=8.9.0,<8.9.1 | >=9.0.0,<9.0.1 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.8.8, 8.9.1, 9.0.1 |
| 2020-06-17 | Drupal core - Critical - Cross Site Request Forgery - SA-CORE-2020-004 CVE-2020-13663 · FriendsOfPHP/security-advisories, GitHub | high | >=7.0.0,<7.72 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.8.0 | >=8.8.0,<8.8.8 | >=8.9.0,<8.9.1 | >=9.0.0,<9.0.1 | 7.72, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.8.8, 8.9.1, 9.0.1 |
| 2020-06-17 | Drupal core - Less critical - Access bypass - SA-CORE-2020-006 CVE-2020-13665 · FriendsOfPHP/security-advisories, GitHub | critical | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.8.0 | >=8.8.0,<8.8.8 | >=8.9.0,<8.9.1 | >=9.0.0,<9.0.1 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.8.8, 8.9.1, 9.0.1 |
| 2020-05-20 | Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002 CVE-2020-13662 · FriendsOfPHP/security-advisories, GitHub | medium | >=7.0.0,<7.70 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.7.14 | >=8.8.0,<8.8.6 | 7.70, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.7.14, 8.8.6 |
| 2020-05-20 | Drupal core - Moderately critical - Open Redirect - SA-CORE-2020-003 Advisory · FriendsOfPHP/security-advisories, GitHub | medium | >=7.0.0,<7.70 | 7.70 |
| 2020-03-18 | Drupal core - Moderately critical - Third-party library - SA-CORE-2020-001 Advisory · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.7.12 | >=8.8.0,<8.8.4 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.7.12, 8.8.4 |
| 2019-12-18 | Drupal core - Moderately critical - Multiple vulnerabilities - SA-CORE-2019-010 Advisory · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.7.11 | >=8.8.0,<8.8.1 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.7.11, 8.8.1 |
| 2019-12-18 | Drupal core - Moderately critical - Access bypass - SA-CORE-2019-011 Advisory · FriendsOfPHP/security-advisories, GitHub | critical | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.7.11 | >=8.8.0,<8.8.1 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.7.11, 8.8.1 |
| 2019-12-18 | Drupal core - Moderately critical - Denial of Service - SA-CORE-2019-009 Advisory · FriendsOfPHP/security-advisories, GitHub | critical | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.7.11 | >=8.8.0,<8.8.1 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.7.11, 8.8.1 |
| 2019-12-18 | Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2019-012 Advisory · FriendsOfPHP/security-advisories, GitHub | medium | >=7.0.0,<7.69 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.7.0 | >=8.7.0,<8.7.11 | >=8.8.0,<8.8.1 | 7.69, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.7.11, 8.8.1 |
| 2019-07-16 | Critical - Access bypass CVE-2019-6342 · FriendsOfPHP/security-advisories, GitHub | critical | >8.7.3,<8.7.5 | 8.7.5 |
| 2019-05-08 | Moderately critical - Third-party libraries - SA-CORE-2019-007 CVE-2019-11831 · FriendsOfPHP/security-advisories, GitHub | critical | >=7.0.0,<7.67.0 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.6.0 | >=8.6.0,<8.6.16 | >=8.7.0,<8.7.1 | 7.67.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.6.16, 8.7.1 |
| 2019-04-17 | Drupal core - Moderately critical - Multiple Vulnerabilities - SA-CORE-2019-005 CVE-2019-10909 · FriendsOfPHP/security-advisories, GitHub | medium | >=7.0,<7.65 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.5.14 | >=8.6.0,<8.6.14 | 7.65, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.5.14, 8.6.14 |
| 2019-03-20 | Moderately critical - Cross Site Scripting - SA-CORE-2019-004 CVE-2019-6341 · FriendsOfPHP/security-advisories, GitHub | medium | >=7.0.0,<7.65.0 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.5.14 | >=8.6.0,<8.6.13 | 7.65.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.5.14, 8.6.13 |
| 2019-02-20 | Highly critical - Remote Code Execution CVE-2019-6340 · FriendsOfPHP/security-advisories, GitHub | high | >=7.0.0,<7.62.0 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.5.11 | >=8.6.0,<8.6.10 | 7.62.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.5.11, 8.6.10 |
| 2019-01-15 | Critical - Third Party Libraries CVE-2019-6338 · FriendsOfPHP/security-advisories | unscored | >=7.0.0,<7.62.0 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.5.9 | >=8.6.0,<8.6.6 | 7.62.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.5.9, 8.6.6 |
| 2019-01-15 | Critical - Arbitrary PHP code execution CVE-2019-6339 · FriendsOfPHP/security-advisories, GitHub | critical | >=7.0.0,<7.62.0 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.5.9 | >=8.6.0,<8.6.6 | 7.62.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.5.9, 8.6.6 |
| 2018-10-17 | Contextual Links validation - Critical - Remote Code Execution Advisory · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.5.8 | >=8.6.0,<8.6.2 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.5.8, 8.6.2 |
| 2018-10-17 | Injection in DefaultMailSystem::mail() - Critical - Remote Code Execution Advisory · FriendsOfPHP/security-advisories, GitHub | medium | >=7.0,<7.60 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.5.8 | >=8.6.0,<8.6.2 | 7.60, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.5.8, 8.6.2 |
| 2018-10-17 | Content moderation - Moderately critical - Access bypass Advisory · FriendsOfPHP/security-advisories, GitHub | high | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.5.8 | >=8.6.0,<8.6.2 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.5.8, 8.6.2 |
| 2018-10-17 | External URL injection through URL aliases - Moderately Critical - Open Redirect Advisory · FriendsOfPHP/security-advisories, GitHub | medium | >=7.0,<7.60 | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.5.8 | >=8.6.0,<8.6.2 | 7.60, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.5.8, 8.6.2 |
| 2018-10-17 | Anonymous Open Redirect - Moderately Critical - Open Redirect Advisory · FriendsOfPHP/security-advisories, GitHub | high | >=8.0.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.5.0 | >=8.5.0,<8.5.8 | >=8.6.0,<8.6.2 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.5.8, 8.6.2 |
| 2018-04-25 | Critical - Remote Code Execution CVE-2018-7602 · FriendsOfPHP/security-advisories, GitHub | critical | >=7.0,<7.59 | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4,<8.4.8 | >=8.5,<8.5.3 | 7.59, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.4.8, 8.5.3 |
| 2018-04-18 | Moderately critical - Cross Site Scripting CVE-2018-9861 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4,<8.4.7 | >=8.5,<8.5.2 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.4.7, 8.5.2 |
| 2018-03-28 | Highly critical - Remote Code Execution CVE-2018-7600 · FriendsOfPHP/security-advisories, GitHub | critical | >=7.0,<7.58 | >=8.0,<8.3.9 | >=8.4,<8.4.6 | >=8.5,<8.5.1 | 7.58, 8.3.9, 8.4.6, 8.5.1 |
| 2018-02-20 | Settings Tray access bypass. CVE-2017-6931 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.4.5 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.4.5 |
| 2018-02-20 | Comment reply form allows access to restricted content. CVE-2017-6926 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.4.5 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.4.5 |
| 2018-02-20 | jQuery vulnerability with untrusted domains. CVE-2017-6929 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.4.5 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.4.5 |
| 2018-02-20 | External link injection on 404 pages when linking to the current page. CVE-2017-6932 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.4.5 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.4.5 |
| 2018-02-20 | JavaScript cross-site scripting prevention is incomplete. CVE-2017-6927 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.4.5 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.4.5 |
| 2018-02-20 | Private file access bypass. CVE-2017-6928 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.4.5 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.4.5 |
| 2018-02-20 | Language fallback can be incorrect on multilingual sites with node access restrictions. CVE-2017-6930 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.4.0 | >=8.4.0,<8.4.5 | 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.4.5 |
| 2017-08-16 | REST API can bypass comment approval. CVE-2017-6924 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.3.7 | 8.1.0, 8.2.0, 8.3.0, 8.3.7 |
| 2017-08-16 | Entity access bypass for entities that do not have UUIDs or have protected revisions. CVE-2017-6925 · FriendsOfPHP/security-advisories, GitHub | critical | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.3.7 | 8.1.0, 8.2.0, 8.3.0, 8.3.7 |
| 2017-08-16 | Views does not properly restrict access to the Ajax endpoint. CVE-2017-6923 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.3.7 | 8.1.0, 8.2.0, 8.3.0, 8.3.7 |
| 2017-06-21 | PECL YAML parser unsafe object handling CVE-2017-6920 · FriendsOfPHP/security-advisories, GitHub | critical | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.3.4 | 8.1.0, 8.2.0, 8.3.0, 8.3.4 |
| 2017-06-21 | File REST resource does not properly validate CVE-2017-6921 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.3.4 | 8.1.0, 8.2.0, 8.3.0, 8.3.4 |
| 2017-06-21 | Files uploaded by anonymous users into a private file system can be accessed by other anonymous users CVE-2017-6922 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.3.0 | >=8.3.0,<8.3.4 | 8.1.0, 8.2.0, 8.3.0, 8.3.4 |
| 2017-04-19 | Access bypass CVE-2017-6919 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.2.8 | >=8.3.0,<8.3.1 | 8.1.0, 8.2.0, 8.2.8, 8.3.1 |
| 2017-03-15 | Editor module incorrectly checks access to inline private files CVE-2017-6377 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.2.7 | 8.1.0, 8.2.0, 8.2.7 |
| 2017-03-15 | Some admin paths were not protected with a CSRF token CVE-2017-6379 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.2.7 | 8.1.0, 8.2.0, 8.2.7 |
| 2017-03-15 | Remote code execution CVE-2017-6381 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.2.7 | 8.1.0, 8.2.0, 8.2.7 |
| 2016-11-16 | Denial of service via transliterate mechanism CVE-2016-9452 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.2.3 | 8.1.0, 8.2.0, 8.2.3 |
| 2016-11-16 | Incorrect cache context on password reset page CVE-2016-9450 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.2.3 | 8.1.0, 8.2.0, 8.2.3 |
| 2016-11-16 | Inconsistent name for term access query CVE-2016-9449 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.2.0 | >=8.2.0,<8.2.3 | 8.1.0, 8.2.0, 8.2.3 |
| 2016-09-21 | Users without "Administer comments" can set comment visibility on nodes they can edit CVE-2016-7570 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.1.10 | 8.1.0, 8.1.10 |
| 2016-09-21 | Cross-site Scripting in http exceptions CVE-2016-7571 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.1.10 | 8.1.0, 8.1.10 |
| 2016-09-21 | Full config export can be downloaded without administrative permissions CVE-2016-7572 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.1.10 | 8.1.0, 8.1.10 |
| 2016-07-18 | Drupal Core - Highly Critical - Injection - SA-CORE-2016-003 CVE-2016-5385 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.1.0 | >=8.1.0,<8.1.7 | 8.1.0, 8.1.7 |
| 2016-06-15 | Views can allow unauthorized users to see Statistics information CVE-2016-6212 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.1.0 | >=8.1.0,<8.1.3 | 8.1.0, 8.1.3 |
| 2016-06-15 | Saving user accounts can sometimes grant the user all roles CVE-2016-6211 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.1.0 | >=8.1.0,<8.1.3 | 8.1.0, 8.1.3 |
| 2016-02-15 | Open redirect via path manipulation CVE-2016-3164 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.0.4 | 8.0.4 |
| 2016-02-15 | Email address can be matched to an account CVE-2016-3170 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.0.4 | 8.0.4 |
| 2016-02-15 | Saving user accounts can sometimes grant the user all roles CVE-2016-3169 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.0.4 | 8.0.4 |
| 2016-02-15 | Form API ignores access restrictions on submit buttons CVE-2016-3165 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.0.4 | 8.0.4 |
| 2016-02-15 | Brute force amplification attacks via XML-RPC CVE-2016-3163 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.0.4 | 8.0.4 |
| 2016-02-15 | Reflected file download vulnerability CVE-2016-3168 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.0.4 | 8.0.4 |
| 2016-02-15 | HTTP header injection using line breaks CVE-2016-3166 · FriendsOfPHP/security-advisories, GitHub | medium | >=8.0,<8.0.4 | 8.0.4 |
| 2016-02-15 | File upload access bypass and denial of service CVE-2016-3162 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.0.4 | 8.0.4 |
| 2016-02-15 | Session data truncation can lead to unserialization of user provided data CVE-2016-3171 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.0.4 | 8.0.4 |
| 2016-02-15 | Open redirect via double-encoded 'destination' parameter CVE-2016-3167 · FriendsOfPHP/security-advisories, GitHub | high | >=8.0,<8.0.4 | 8.0.4 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about drupal/core
Does drupal/core have known vulnerabilities?
Yes. Packagist lists 112 security advisories for drupal/core (15 critical, 33 high, 58 medium, 5 low severity). The most recent, reported 2026-05-20, is "Drupal Core has a SQL Injection issue". The newest release, 11.4.11, is outside every affected range.
Which version of drupal/core should I run?
The newest stable release is 11.4.11 (published 2026-10-21). The most recent advisory is fixed in 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12 and 11.3.10, so stay on or above the fixed version for your major version. Run composer update drupal/core, then composer audit to confirm nothing else is flagged.
How do I check if my drupal/core version is affected?
Run composer show drupal/core in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.