Is drupal/core 11.3 vulnerable?
Composer · 20 releases from 11.3.0 to 11.3.20 · latest drupal/core is 11.4.11 · checked 1 Nov 2026
No known advisories in the last release
drupal/core 11.3.20, the last 11.3 release, has no known advisories. 20 advisories affect earlier 11.3.x releases, so update to 11.3.20.
composer require drupal/core:^11.3.20Fixed within 11.3.x, affecting earlier releases
No summary published
- Affected
- >=10.3.0 <10.6.19 · >=11.0.0 <11.3.19 · >=11.4.0 <11.4.10 · >=12.0.0-alpha1 <12.0.0-beta2
- Fixed in
- 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2
No summary published
- Affected
- >=8.9.0 <10.6.19 · >=11.0.0 <11.3.19 · >=11.4.0 <11.4.10 · >=12.0.0-alpha1 <12.0.0-beta2
- Fixed in
- 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2
No summary published
- Affected
- >=8.9.0 <10.6.19 · >=11.0.0 <11.3.19 · >=11.4.0 <11.4.10 · >=12.0.0-alpha1 <12.0.0-beta2
- Fixed in
- 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2
No summary published
- Affected
- >=10.5.0 <10.6.17 · >=11.0.0 <11.3.17 · >=11.4.0 <11.4.7
- Fixed in
- 10.6.17, 11.3.17, 11.4.7
No summary published
- Affected
- <10.6.13 · >=11.3.0 <11.3.14 · >=11.4.0 <11.4.4 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0 · >=11.2.0 <11.3.0
- Fixed in
- 10.6.13, 11.1.0, 11.2.0, 11.3.0, 11.3.14, 11.4.4
No summary published
- Affected
- >=11.3.0 <11.3.14 · >=11.4.0 <11.4.4 · >=11.2.0 <11.3.0
- Fixed in
- 11.3.0, 11.3.14, 11.4.4
No summary published
- Affected
- <10.6.13 · >=11.3.0 <11.3.14 · >=11.4.0 <11.4.4 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0 · >=11.2.0 <11.3.0
- Fixed in
- 10.6.13, 11.1.0, 11.2.0, 11.3.0, 11.3.14, 11.4.4
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
Drupal Core has a SQL Injection issue
- Affected
- >=8.9.0 <10.4.10 · >=10.5.0 <10.5.10 · >=10.6.0 <10.6.9 · >=11.0.0 <11.1.10 · >=11.2.0 <11.2.12 · >=11.3.0 <11.3.10
- Fixed in
- 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10
No summary published
- Affected
- >=8.9.0 <10.4.10 · >=10.5.0 <10.5.10 · >=10.6.0 <10.6.9 · >=11.0.0 <11.1.10 · >=11.2.0 <11.2.12 · >=11.3.0 <11.3.10
- Fixed in
- 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10
Drupal core is Vulnerable to Cross-Site Scripting
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
Drupal core allows Cross-Site Scripting (XSS)
- Affected
- >=11.3.0 <11.3.7
- Fixed in
- 11.3.7
Drupal core allows Object Injection
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
No summary published
- Affected
- >=11.3.0 <11.3.7
- Fixed in
- 11.3.7
No summary published
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
No summary published
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
Which of your client projects are still on drupal/core 11.3?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact drupal/core version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other drupal/core versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.