# drupal/core-recommended (Packagist) vulnerabilities

6 known vulnerabilities (3 critical, 1 high, 2 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/drupal/core-recommended

## Advisories (6)

### [CVE-2024-55638](https://cve.now/CVE-2024-55638): Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008

- Severity: Critical 9.8
- Published: Dec 9, 2024
- Affected: from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 7.0, fixed in 7.102.

### [CVE-2024-55637](https://cve.now/CVE-2024-55637): Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007

- Severity: Critical 9.8
- Published: Dec 9, 2024
- Affected: from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

### [CVE-2024-55636](https://cve.now/CVE-2024-55636): Drupal core - Less critical - Gadget chain - SA-CORE-2024-006

- Severity: Critical 9.8
- Published: Dec 9, 2024
- Affected: from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

### [CVE-2024-55634](https://cve.now/CVE-2024-55634): Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004

- Severity: High 8.1
- Published: Dec 9, 2024
- Affected: from 8.0.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

### [CVE-2024-12393](https://cve.now/CVE-2024-12393): Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003

- Severity: Medium 5.4
- Published: Dec 9, 2024
- Affected: from 8.8.0, fixed in 10.2.11; from 10.3.0, fixed in 10.3.9; from 11.0.0, fixed in 11.0.8.

### [CVE-2024-45440](https://cve.now/CVE-2024-45440): core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash\_salt is…

- Severity: Medium 5.3
- Published: Aug 29, 2024
- Affected: from 10.3.0, fixed in 10.3.6; from 11.0.0, fixed in 11.0.5; from 8.0.0, fixed in 10.2.9.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/drupal/core-recommended
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.