CVE-2026-55807

1 advisory.

Packagist/drupal/core CVE-2026-55807: unknown, EPSS 0.22%

The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via `providers.json` and via URL discovery.

Action: Upgrade drupal/core to 10.5.12 or later.

composer require drupal/core:10.5.12

composer require drupal/core:10.6.11

composer require drupal/core:11.2.14

composer require drupal/core:11.3.12

composer require drupal/core:11.1.0

composer require drupal/core:11.2.0

Affected

introduced	fixed	last affected
0	10.5.12	-
10.6.0	10.6.11	-
11.2.0	11.2.14	-
11.3.0	11.3.12	-
11.0.0	11.1.0	-
11.1.0	11.2.0	-

Fixed versions

10.5.12

10.6.11

11.2.14

11.3.12

11.1.0

11.2.0

Sources

osv: DRUPAL-CORE-2026-008
https://www.drupal.org/sa-core-2026-008

CVE-2026-55807 · published 2026-06-17T18:57:49Z · modified 2026-09-10T03:45:13.576652334Z · JSON