Drupal Core CVE-2026-15916

SQL injection in Drupal core (versions 8.9.0 through the fixed 10.4.10/10.5.10/10.6.9 and 11.x branches through 11.3.10)

Object injection in Drupal Core across branches 8.0.0 through 11.3.x allows a network-accessible, highly privileged auth

Cross-site scripting in Drupal core 11.3.0 through 11.3.6 enables unauthenticated remote attackers to inject malicious s

Cross-site scripting in Drupal Core exposes a broad range of Drupal installations - spanning major versions 8 through 11

Object injection in Drupal Core through improperly controlled modification of dynamically-determined object attributes (

Object injection via a mass assignment flaw in Drupal Core enables an authenticated administrator to manipulate dynamica

Open redirect in Drupal Core across multiple major release branches enables phishing and content spoofing attacks by for

Stored XSS in Drupal Core allows authenticated low-privileged users to inject persistent malicious scripts that execute

Cross-site scripting (XSS) in Drupal Core affects a broad swath of the 10.x and 11.x release lines, enabling an authenti

Cross-site scripting in Drupal Core across all maintained 11.x release branches allows network-accessible unauthenticate

Server-Side Request Forgery in Drupal Core allows authenticated low-privilege users to coerce the application server int