Drupal Core
Monthly
SQL injection in Drupal core (versions 8.9.0 through the fixed 10.4.10/10.5.10/10.6.9 and 11.x branches through 11.3.10) allows attackers to inject arbitrary SQL against the site database, per SA-CORE-2026-004. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code (Exploit-DB 52608 and multiple public PoCs), and the CVSS 9.8 vector indicates unauthenticated remote exploitation. Notably, EPSS remains extremely low (0.01%) and SSVC lists exploitation as 'none', signaling either targeted rather than widespread activity or conflicting source data that defenders should treat cautiously while still prioritizing the patch given KEV status.
Forceful Browsing in Drupal Core across multiple active and end-of-life release branches (10.x through 10.6.13, 11.3.x through 11.3.14, 11.4.x through 11.4.4, and all 11.0.x-11.2.x) allows unauthenticated remote attackers to bypass authorization and directly access protected resources due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates network-reachable exploitation but with high complexity and required user interaction, limiting opportunistic mass attacks. No active exploitation is confirmed - EPSS stands at 0.13% (3rd percentile) and CISA SSVC rates exploitation as none and not automatable - but a vendor patch is available via SA-CORE-2026-010.
Cross-site scripting in Drupal Core across all maintained 11.x release branches allows network-accessible unauthenticated attackers to inject malicious scripts into rendered web pages, with impact occurring in victims' browser contexts upon user interaction. High attack complexity (AC:H) constrains opportunistic exploitation, and all signals - EPSS at 0.15% (4th percentile), SSVC exploitation status of none, no KEV listing, and no public exploit code - converge on a low-urgency posture. Vendor patches are available for the 11.3.x and 11.4.x branches via Drupal SA-CORE-2026-011, while Drupal 11.2.x and earlier receive no fix as an end-of-life branch.
Stored XSS in Drupal Core allows authenticated low-privileged users to inject persistent malicious scripts that execute in the browsers of other site visitors, including administrators. The vulnerability spans multiple Drupal release trains - 10.x through 10.6.x, and all 11.0.*, 11.1.*, and 11.2.* branches - and is addressed in patched releases 10.6.13, 11.3.14, and 11.4.4 per the vendor advisory SA-core-2026-012. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation as none with non-automatable attack paths, placing this at moderate real-world priority despite scope change in the CVSS vector.
Cross-site scripting (XSS) in Drupal Core affects a broad swath of the 10.x and 11.x release lines, enabling an authenticated low-privileged attacker to inject malicious client-side script that executes in the browser of a victim who interacts with the crafted content. The CVSS scope-change indicator (S:C) confirms the impact escapes the originating component into the victim's browser context, enabling session hijacking or privilege escalation against higher-privileged users. No public exploit code has been identified and EPSS sits at 0.15% (5th percentile), indicating low automated exploitation probability at time of analysis, though the wide deployment footprint of Drupal still makes patching urgent.
Server-Side Request Forgery in Drupal Core allows authenticated low-privilege users to coerce the application server into issuing unauthorized HTTP requests to internal or restricted network destinations. All active 10.6.x and 11.x release branches are affected, along with end-of-life 11.0.x and 11.1.x branches, covering a broad swath of production Drupal deployments. No public exploit code has been identified and EPSS sits at the 3rd percentile, but the large Drupal deployment footprint elevates aggregate exposure even at low per-instance exploitation probability.
Open redirect in Drupal Core across multiple major release branches enables phishing and content spoofing attacks by forwarding victims from a trusted Drupal domain to an attacker-controlled site via crafted URLs. The exposure spans the 10.x and 11.x release trains, creating a broad attack surface across the Drupal install base. EPSS probability sits at 0.13% (3rd percentile) and the vulnerability is absent from CISA KEV, indicating low observed exploitation to date despite the wide version coverage.
Object injection in Drupal Core through improperly controlled modification of dynamically-determined object attributes (CWE-915) exposes sites to high-severity confidentiality and integrity compromise when triggered by an authenticated user with high privileges. Affected branches include the entire 10.x line before 10.5.12 and 10.6.11, the fully unsupported 11.0.x and 11.1.x trees, and the 11.2.x and 11.3.x lines before 11.2.14 and 11.3.12 respectively. No active exploitation is confirmed (not in CISA KEV) and EPSS sits at just 0.16% (6th percentile), making this a patch-priority rather than emergency-response scenario.
Object injection via a mass assignment flaw in Drupal Core enables an authenticated administrator to manipulate dynamically-determined PHP object attributes, potentially compromising confidentiality and data integrity of the application. Affected versions span multiple active and end-of-life branches: 10.5.x through 10.5.12, 10.6.0 through 10.6.11, 11.2.0 through 11.2.14, 11.3.0 through 11.3.12, and the entirely unsupported 11.0.x and 11.1.x branches. No public exploit code is identified at time of analysis, and EPSS at 0.16% (6th percentile) signals very low observed exploitation activity despite the C:H/I:H impact potential.
Cross-site scripting in Drupal core 11.3.0 through 11.3.6 enables unauthenticated remote attackers to inject malicious scripts into web pages rendered by the application, which execute in victims' browsers upon user interaction. The CVSS Changed scope (S:C) indicator confirms the exploit crosses trust boundaries - attacker-controlled input rendered in the victim's browser context can compromise session tokens or trigger unauthorized actions. With EPSS at 0.03% (8th percentile) and no CISA KEV listing, widespread exploitation is not currently observed; a vendor patch is available in 11.3.7.
Object injection in Drupal Core across branches 8.0.0 through 11.3.x allows a network-accessible, highly privileged authenticated user to manipulate dynamically-determined object attributes, with potential full compromise of confidentiality, integrity, and availability. The CVSS vector (AV:N/AC:H/PR:H) confirms this is a network-reachable flaw but imposes steep prerequisites: administrator-level access and high attack complexity. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Cross-site scripting in Drupal Core exposes a broad range of Drupal installations - spanning major versions 8 through 11 - to client-side script injection exploitable by unauthenticated remote attackers who can induce user interaction. The Changed scope (S:C) in the CVSS vector confirms the injected script executes in the context of a victim's browser session, enabling session hijacking, credential theft, or malicious redirects against authenticated users including administrators. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% (8th percentile) signals low near-term exploitation probability, though the breadth of affected versions across three major release lines increases the aggregate attack surface.
SQL injection in Drupal core (versions 8.9.0 through the fixed 10.4.10/10.5.10/10.6.9 and 11.x branches through 11.3.10) allows attackers to inject arbitrary SQL against the site database, per SA-CORE-2026-004. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code (Exploit-DB 52608 and multiple public PoCs), and the CVSS 9.8 vector indicates unauthenticated remote exploitation. Notably, EPSS remains extremely low (0.01%) and SSVC lists exploitation as 'none', signaling either targeted rather than widespread activity or conflicting source data that defenders should treat cautiously while still prioritizing the patch given KEV status.
Forceful Browsing in Drupal Core across multiple active and end-of-life release branches (10.x through 10.6.13, 11.3.x through 11.3.14, 11.4.x through 11.4.4, and all 11.0.x-11.2.x) allows unauthenticated remote attackers to bypass authorization and directly access protected resources due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates network-reachable exploitation but with high complexity and required user interaction, limiting opportunistic mass attacks. No active exploitation is confirmed - EPSS stands at 0.13% (3rd percentile) and CISA SSVC rates exploitation as none and not automatable - but a vendor patch is available via SA-CORE-2026-010.
Cross-site scripting in Drupal Core across all maintained 11.x release branches allows network-accessible unauthenticated attackers to inject malicious scripts into rendered web pages, with impact occurring in victims' browser contexts upon user interaction. High attack complexity (AC:H) constrains opportunistic exploitation, and all signals - EPSS at 0.15% (4th percentile), SSVC exploitation status of none, no KEV listing, and no public exploit code - converge on a low-urgency posture. Vendor patches are available for the 11.3.x and 11.4.x branches via Drupal SA-CORE-2026-011, while Drupal 11.2.x and earlier receive no fix as an end-of-life branch.
Stored XSS in Drupal Core allows authenticated low-privileged users to inject persistent malicious scripts that execute in the browsers of other site visitors, including administrators. The vulnerability spans multiple Drupal release trains - 10.x through 10.6.x, and all 11.0.*, 11.1.*, and 11.2.* branches - and is addressed in patched releases 10.6.13, 11.3.14, and 11.4.4 per the vendor advisory SA-core-2026-012. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation as none with non-automatable attack paths, placing this at moderate real-world priority despite scope change in the CVSS vector.
Cross-site scripting (XSS) in Drupal Core affects a broad swath of the 10.x and 11.x release lines, enabling an authenticated low-privileged attacker to inject malicious client-side script that executes in the browser of a victim who interacts with the crafted content. The CVSS scope-change indicator (S:C) confirms the impact escapes the originating component into the victim's browser context, enabling session hijacking or privilege escalation against higher-privileged users. No public exploit code has been identified and EPSS sits at 0.15% (5th percentile), indicating low automated exploitation probability at time of analysis, though the wide deployment footprint of Drupal still makes patching urgent.
Server-Side Request Forgery in Drupal Core allows authenticated low-privilege users to coerce the application server into issuing unauthorized HTTP requests to internal or restricted network destinations. All active 10.6.x and 11.x release branches are affected, along with end-of-life 11.0.x and 11.1.x branches, covering a broad swath of production Drupal deployments. No public exploit code has been identified and EPSS sits at the 3rd percentile, but the large Drupal deployment footprint elevates aggregate exposure even at low per-instance exploitation probability.
Open redirect in Drupal Core across multiple major release branches enables phishing and content spoofing attacks by forwarding victims from a trusted Drupal domain to an attacker-controlled site via crafted URLs. The exposure spans the 10.x and 11.x release trains, creating a broad attack surface across the Drupal install base. EPSS probability sits at 0.13% (3rd percentile) and the vulnerability is absent from CISA KEV, indicating low observed exploitation to date despite the wide version coverage.
Object injection in Drupal Core through improperly controlled modification of dynamically-determined object attributes (CWE-915) exposes sites to high-severity confidentiality and integrity compromise when triggered by an authenticated user with high privileges. Affected branches include the entire 10.x line before 10.5.12 and 10.6.11, the fully unsupported 11.0.x and 11.1.x trees, and the 11.2.x and 11.3.x lines before 11.2.14 and 11.3.12 respectively. No active exploitation is confirmed (not in CISA KEV) and EPSS sits at just 0.16% (6th percentile), making this a patch-priority rather than emergency-response scenario.
Object injection via a mass assignment flaw in Drupal Core enables an authenticated administrator to manipulate dynamically-determined PHP object attributes, potentially compromising confidentiality and data integrity of the application. Affected versions span multiple active and end-of-life branches: 10.5.x through 10.5.12, 10.6.0 through 10.6.11, 11.2.0 through 11.2.14, 11.3.0 through 11.3.12, and the entirely unsupported 11.0.x and 11.1.x branches. No public exploit code is identified at time of analysis, and EPSS at 0.16% (6th percentile) signals very low observed exploitation activity despite the C:H/I:H impact potential.
Cross-site scripting in Drupal core 11.3.0 through 11.3.6 enables unauthenticated remote attackers to inject malicious scripts into web pages rendered by the application, which execute in victims' browsers upon user interaction. The CVSS Changed scope (S:C) indicator confirms the exploit crosses trust boundaries - attacker-controlled input rendered in the victim's browser context can compromise session tokens or trigger unauthorized actions. With EPSS at 0.03% (8th percentile) and no CISA KEV listing, widespread exploitation is not currently observed; a vendor patch is available in 11.3.7.
Object injection in Drupal Core across branches 8.0.0 through 11.3.x allows a network-accessible, highly privileged authenticated user to manipulate dynamically-determined object attributes, with potential full compromise of confidentiality, integrity, and availability. The CVSS vector (AV:N/AC:H/PR:H) confirms this is a network-reachable flaw but imposes steep prerequisites: administrator-level access and high attack complexity. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Cross-site scripting in Drupal Core exposes a broad range of Drupal installations - spanning major versions 8 through 11 - to client-side script injection exploitable by unauthenticated remote attackers who can induce user interaction. The Changed scope (S:C) in the CVSS vector confirms the injected script executes in the context of a victim's browser session, enabling session hijacking, credential theft, or malicious redirects against authenticated users including administrators. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% (8th percentile) signals low near-term exploitation probability, though the breadth of affected versions across three major release lines increases the aggregate attack surface.