tocsin

Packagist/drupal/core CVE-2026-9082: unknown, exploited, EPSS 15.70%

Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks.

Action: Upgrade drupal/core to 10.4.10 or later.

composer require drupal/core:10.4.10
composer require drupal/core:10.5.10
composer require drupal/core:10.6.9
composer require drupal/core:11.1.10
composer require drupal/core:11.2.12
composer require drupal/core:11.3.10

Affected

introducedfixedlast affected
8.9.010.4.10-
10.5.010.5.10-
10.6.010.6.9-
11.0.011.1.10-
11.2.011.2.12-
11.3.011.3.10-

Fixed versions

10.4.1010.5.1010.6.911.1.1011.2.1211.3.10

Sources

CVE-2026-9082 · published · modified · JSON