Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

drupal/core-recommended

6 known vulnerabilities (3 critical, 1 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 3 critical, 1 high, 2 medium
Registry
Packagist

Advisories 6

  • CVE-2024-55638Critical 9.8

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008

    Affected: from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 7.0, fixed in 7.102.

  • CVE-2024-55637Critical 9.8

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007

    Affected: from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

  • CVE-2024-55636Critical 9.8

    Drupal core - Less critical - Gadget chain - SA-CORE-2024-006

    Affected: from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

  • Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004

    Affected: from 8.0.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

  • CVE-2024-12393Medium 5.4

    Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003

    Affected: from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

  • CVE-2024-45440Medium 5.3

    core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is…

    Affected: from 10.3.0, fixed in 10.3.6; from 11.0.0, fixed in 11.0.5; from 8.0.0, fixed in 10.2.9.