Skip to content
Threat Feed
Subscribe

Product

Drupal Core

3 briefs RSS
medium advisory

Cross-Site Scripting Vulnerability in Drupal Core

A vulnerability in Drupal Core allows an unauthenticated attacker to perform a Cross-Site Scripting (XSS) attack to execute malicious scripts in a user's browser.

Drupal Core
1t
medium advisory

Drupal Core: Multiple Vulnerabilities Allowing Information Disclosure and XSS

A remote, unauthenticated attacker can exploit multiple vulnerabilities in Drupal Core to achieve information disclosure and Cross-Site Scripting (XSS) attacks, potentially compromising user data or session integrity.

Drupal Core vulnerability web-application xss information-disclosure cve-less
2t
high threat

Drupal Security Advisory AV26-615: Multiple Critical Vulnerabilities

On June 17, 2026, Drupal released critical security advisories (AV26-615) addressing multiple vulnerabilities in Drupal core and several modules including Plotly.js Graphing, Flag attendance field, and Formatter Field, which, if unpatched, could allow remote attackers to compromise affected web servers and sensitive data.

exploited Drupal core +3 web-application drupal vulnerability cccs-advisory
3r 7t