Is drupal/core 8.3 vulnerable?
Composer · 10 releases from 8.3.0 to 8.3.9 · latest drupal/core is 11.4.11 · checked 1 Nov 2026
Yes: 128 known advisories
Yes. drupal/core 8.3.9, the last 8.3 release, is affected by 128 known security advisories (6 critical, 11 high, 30 medium, 81 low), including CVE-2018-7602, CVE-2020-13675, CVE-2019-6339. 9 more affect earlier 8.3.x releases. Upgrade to 10.6.13 or later to fix all of them.
composer require drupal/core:^10.6.13Advisories affecting drupal/core 8.3.9
No summary published
- Affected
- <10.6.13 · >=11.3.0 <11.3.14 · >=11.4.0 <11.4.4 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0 · >=11.2.0 <11.3.0
- Fixed in
- 10.6.13, 11.1.0, 11.2.0, 11.3.0, 11.3.14, 11.4.4
No summary published
- Affected
- <10.6.13 · >=11.3.0 <11.3.14 · >=11.4.0 <11.4.4 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0 · >=11.2.0 <11.3.0
- Fixed in
- 10.6.13, 11.1.0, 11.2.0, 11.3.0, 11.3.14, 11.4.4
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
Drupal core is Vulnerable to Cross-Site Scripting
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
Drupal core allows Object Injection
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
No summary published
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
No summary published
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
Drupal core allows Object Injection
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
Drupal core allows Forceful Browsing
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
Drupal core allows Content Spoofing
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8 · >=7.0 <7.103
- Fixed in
- 7.103, 10.4.9, 10.5.6, 11.1.9, 11.2.8
No summary published
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
No summary published
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
No summary published
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
No summary published
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
Drupal Core Vulnerable to Forceful Browsing
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
Drupal Core Cross-Site Scripting (XSS) Vulnerability
- Affected
- >=8.0.0 <10.3.14 · >=10.4.0 <10.4.5 · >=11.0.0 <11.0.13 · >=11.1.0 <11.1.5
- Fixed in
- 10.3.14, 10.4.5, 11.0.13, 11.1.5
No summary published
- Affected
- >=8.0.0 <10.3.14 · >=10.4.0 <10.4.5 · >=11.0.0 <11.0.13 · >=11.1.0 <11.1.5
- Fixed in
- 10.3.14, 10.4.5, 11.0.13, 11.1.5
No summary published
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
No summary published
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
No summary published
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
Drupal core Access bypass
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
No summary published
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9
- Fixed in
- 10.2.11, 10.3.9
No summary published
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
No summary published
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
No summary published
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
Drupal Full Path Disclosure
- Affected
- >=10.3.0 <10.3.6 · >=11.0.0 <11.0.5 · >=8.0.0 <10.2.9
- Fixed in
- 10.2.9, 10.3.6, 11.0.5
Drupal core Cross-Site Scripting (XSS) vulnerabilities
- Affected
- >=8.0.0 <8.9.18 · >=9.1.0 <9.1.12 · >=9.2.0 <9.2.4
- Fixed in
- 8.9.18, 9.1.12, 9.2.4
Drupal core Arbitrary PHP code execution
- Affected
- >=7.0.0 <7.75 · >=8.0.0 <8.8.12 · >=8.9.0 <8.9.10 · >=9.0.0 <9.0.9
- Fixed in
- 7.75, 8.8.12, 8.9.10, 9.0.9
Drupal core uses a vulnerable Third-party library CKEditor
- Affected
- >=8.0.0 <8.7.12 · >=8.8.0 <8.8.4
- Fixed in
- 8.7.12, 8.8.4
Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
- Affected
- >=7.0.0 <7.69 · >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 7.69, 8.7.11, 8.8.1
Drupal core Access bypass
- Affected
- >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 8.7.11, 8.8.1
Drupal core unrestricted file upload
- Affected
- >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 8.7.11, 8.8.1
Drupal core Denial of Service
- Affected
- >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 8.7.11, 8.8.1
Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution
- Affected
- >=8.0.0 <8.5.8 · >=8.6.0 <8.6.2
- Fixed in
- 8.5.8, 8.6.2
Drupal core Remote Code Execution
- Affected
- >=7.0 <7.60 · >=8.0.0 <8.5.8 · >=8.6.0 <8.6.2
- Fixed in
- 7.60, 8.5.8, 8.6.2
Drupal Anonymous Open Redirect
- Affected
- >=8.0.0 <8.5.8 · >=8.6.0 <8.6.2
- Fixed in
- 8.5.8, 8.6.2
Drupal External URL injection through URL aliases leading to Open Redirect
- Affected
- >=7.0 <7.60 · >=8.0.0 <8.5.8 · >=8.6.0 <8.6.2
- Fixed in
- 7.60, 8.5.8, 8.6.2
Drupal Content moderation Access bypass
- Affected
- >=8.0.0 <8.5.8 · >=8.6.0 <8.6.2
- Fixed in
- 8.5.8, 8.6.2
Drupal Core Remote Code Execution Vulnerability
- Affected
- >=7.0 <7.59 · >=8.0 <8.4.8 · >=8.5 <8.5.3
- Fixed in
- 7.59, 8.4.8, 8.5.3
Drupal core Denial of Service vulnerability
- Affected
- >=8.0.0 <10.1.8 · >=10.2.0 <10.2.2
- Fixed in
- 10.1.8, 10.2.2
No summary published
- Affected
- >=8.0.0 <10.1.8 · >=10.2.0 <10.2.2
- Fixed in
- 10.1.8, 10.2.2
Improper input validation in Drupal core
- Affected
- >=8.0.0 <9.2.18 · >=9.3.0 <9.3.12
- Fixed in
- 9.2.18, 9.3.12
Lack of domain validation in Druple core
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
Access bypass in Drupal Core
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.4.14 · >=9.5.0 <9.5.8 · >=10.0.0 <10.0.8
- Fixed in
- 9.4.14, 9.5.8, 10.0.8
No summary published
- Affected
- >=8.0.0 <9.4.12 · >=9.5.0 <9.5.5 · >=10.0.0 <10.0.5
- Fixed in
- 9.4.12, 9.5.5, 10.0.5
No summary published
- Affected
- >=8.0.0 <9.4.12 · >=9.5.0 <9.5.5 · >=10.0.0 <10.0.5
- Fixed in
- 9.4.12, 9.5.5, 10.0.5
No summary published
- Affected
- >=8.0.0 <9.4.12 · >=9.5.0 <9.5.5 · >=10.0.0 <10.0.5
- Fixed in
- 9.4.12, 9.5.5, 10.0.5
No summary published
- Affected
- >=8.0.0 <9.4.10 · >=9.5.0 <9.5.2 · >=10.0.0 <10.0.2
- Fixed in
- 9.4.10, 9.5.2, 10.0.2
No summary published
- Affected
- >=8.0.0 <9.3.22 · >=9.4.0 <9.4.7
- Fixed in
- 9.3.22, 9.4.7
Drupal core arbitrary PHP code execution
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
Drupal core Information Disclosure vulnerability
- Affected
- >=7.0.0 <7.91 · >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 7.91, 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.2.21 · >=9.3.0 <9.3.16
- Fixed in
- 9.2.21, 9.3.16
No summary published
- Affected
- >=8.0.0 <9.2.20 · >=9.3.0 <9.3.14
- Fixed in
- 9.2.20, 9.3.14
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability
- Affected
- >=8.9.0 <8.9.1 · >=9.0.0 <9.0.1 · >=7.0.0 <7.72 · >=8.0.0 <8.8.8
- Fixed in
- 7.72, 8.8.8, 8.9.1, 9.0.1
Drupal Cross Site Scripting (XSS) vulnerability
- Affected
- >=7.0.0 <7.65.0 · >=8.0.0 <8.5.14 · >=8.6.0 <8.6.13
- Fixed in
- 7.65.0, 8.5.14, 8.6.13
Drupal cross site scripting vulnerability
- Affected
- >=7.0 <7.57 · >=8.0 <8.4.0
- Fixed in
- 7.57, 8.4.0
Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)
- Affected
- >=8.5.0 <8.5.2 · >=8.0 <8.4.7
- Fixed in
- 8.4.7, 8.5.2
Drupal Core Remote Code Execution Vulnerability
- Affected
- >=8.6.0 <8.6.10 · >=7.0.0 <7.62.0 · >=8.0.0 <8.5.11
- Fixed in
- 7.62.0, 8.5.11, 8.6.10
No summary published
- Affected
- >=8.0.0 <9.2.18 · >=9.3.0 <9.3.12
- Fixed in
- 9.2.18, 9.3.12
No summary published
- Affected
- >=8.0.0 <9.2.16 · >=9.3.0 <9.3.9
- Fixed in
- 9.2.16, 9.3.9
No summary published
- Affected
- >=8.0.0 <9.2.15 · >=9.3.0 <9.3.8
- Fixed in
- 9.2.15, 9.3.8
Improper input validation in Drupal core
- Affected
- >=9.3.0 <9.3.6 · >=8.0.0 <9.2.13 · >=7.0.0 <7.88
- Fixed in
- 7.88, 9.2.13, 9.3.6
Incorrect authorization in Drupal core
- Affected
- >=9.3.0 <9.3.6 · >=8.0.0 <9.2.13
- Fixed in
- 9.2.13, 9.3.6
No summary published
- Affected
- >=8.0.0 <9.2.13 · >=9.3.0 <9.3.6
- Fixed in
- 9.2.13, 9.3.6
No summary published
- Affected
- >=8.0.0 <9.2.13 · >=9.3.0 <9.3.6
- Fixed in
- 9.2.13, 9.3.6
Unrestricted Upload of File with Dangerous Type in Drupal core
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
Exposure of Resource to Wrong Sphere in Drupal Core
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
Drupal core Cross-site Scripting (XSS) vulnerability
- Affected
- >=7.0.0 <7.80 · >=8.0.0 <8.9.14 · >=9.0.0 <9.0.12 · >=9.1.0 <9.1.7
- Fixed in
- 7.80, 8.9.14, 9.0.12, 9.1.7
Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
Cross-Site Request Forgery in Drupal core
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
Cross-site Scripting in Drupal Core
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
Drupal core access bypass vulnerability
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
Incorrect Authorization in Drupal core
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
No summary published
- Affected
- >=8.0.0 <9.2.11 · >=9.3.0 <9.3.3
- Fixed in
- 9.2.11, 9.3.3
Arbitrary PHP code execution in Drupal
- Affected
- >=7.0.0 <7.62.0 · >=8.0.0 <8.5.9 · >=8.6.0 <8.6.6
- Fixed in
- 7.62.0, 8.5.9, 8.6.6
No summary published
- Affected
- >=8.0.0 <8.9.20 · >=9.1.0 <9.1.14 · >=9.2.0 <9.2.9
- Fixed in
- 8.9.20, 9.1.14, 9.2.9
Drupal core Unrestricted Upload of File with Dangerous Type
- Affected
- >=9.0.0 <9.0.8 · >=8.9.0 <8.9.9 · >=8.0.0 <8.8.11 · >=7.0.0 <7.74
- Fixed in
- 7.74, 8.8.11, 8.9.9, 9.0.8
Directory Traversal in typo3/phar-stream-wrapper
- Affected
- >=7.0.0 <7.67.0 · >=8.0.0 <8.6.16 · >=8.7.0 <8.7.1
- Fixed in
- 7.67.0, 8.6.16, 8.7.1
No summary published
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
No summary published
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
No summary published
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
No summary published
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
No summary published
- Affected
- >=8.0.0 <8.9.19 · >=9.1.0 <9.1.13 · >=9.2.0 <9.2.6
- Fixed in
- 8.9.19, 9.1.13, 9.2.6
No summary published
- Affected
- >=8.0.0 <8.9.18 · >=9.1.0 <9.1.12 · >=9.2.0 <9.2.4
- Fixed in
- 8.9.18, 9.1.12, 9.2.4
No summary published
- Affected
- >=8.0.0 <8.9.17 · >=9.1.0 <9.1.11 · >=9.2.0 <9.2.2
- Fixed in
- 8.9.17, 9.1.11, 9.2.2
ckeditor4 vulnerable to cross-site scripting
- Affected
- >=7.0.0 <7.80 · >=8.0.0 <8.9.16 · >=9.0.0 <9.0.14 · >=9.1.0 <9.1.9
- Fixed in
- 7.80, 8.9.16, 9.0.14, 9.1.9
No summary published
- Affected
- >=8.0.0 <8.9.16 · >=9.0.0 <9.0.14 · >=9.1.0 <9.1.9
- Fixed in
- 8.9.16, 9.0.14, 9.1.9
No summary published
- Affected
- >=8.0.0 <8.9.14 · >=9.0.0 <9.0.12 · >=9.1.0 <9.1.7
- Fixed in
- 8.9.14, 9.0.12, 9.1.7
No summary published
- Affected
- >=8.0.0 <8.9.13 · >=9.0.0 <9.0.11 · >=9.1.0 <9.1.3
- Fixed in
- 8.9.13, 9.0.11, 9.1.3
No summary published
- Affected
- >=8.0.0 <8.8.12 · >=8.9.0 <8.9.10 · >=9.0.0 <9.0.9
- Fixed in
- 8.8.12, 8.9.10, 9.0.9
No summary published
- Affected
- >=8.0.0 <8.8.11 · >=8.9.0 <8.9.9 · >=9.0.0 <9.0.8
- Fixed in
- 8.8.11, 8.9.9, 9.0.8
No summary published
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
No summary published
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
No summary published
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
No summary published
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
No summary published
- Affected
- >=8.0.0 <8.8.10 · >=8.9.0 <8.9.6 · >=9.0.0 <9.0.6
- Fixed in
- 8.8.10, 8.9.6, 9.0.6
No summary published
- Affected
- >=8.0.0 <8.8.8 · >=8.9.0 <8.9.1 · >=9.0.0 <9.0.1
- Fixed in
- 8.8.8, 8.9.1, 9.0.1
No summary published
- Affected
- >=8.0.0 <8.8.8 · >=8.9.0 <8.9.1 · >=9.0.0 <9.0.1
- Fixed in
- 8.8.8, 8.9.1, 9.0.1
No summary published
- Affected
- >=8.0.0 <8.8.8 · >=8.9.0 <8.9.1 · >=9.0.0 <9.0.1
- Fixed in
- 8.8.8, 8.9.1, 9.0.1
No summary published
- Affected
- >=8.0.0 <8.7.14 · >=8.8.0 <8.8.6
- Fixed in
- 8.7.14, 8.8.6
No summary published
- Affected
- >=8.0.0 <8.7.12 · >=8.8.0 <8.8.4
- Fixed in
- 8.7.12, 8.8.4
No summary published
- Affected
- >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 8.7.11, 8.8.1
No summary published
- Affected
- >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 8.7.11, 8.8.1
No summary published
- Affected
- >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 8.7.11, 8.8.1
No summary published
- Affected
- >=8.0.0 <8.7.11 · >=8.8.0 <8.8.1
- Fixed in
- 8.7.11, 8.8.1
Symfony Cross-site Scripting (XSS) vulnerability
- Affected
- >=8.0.0 <8.5.15 · >=8.6.0 <8.6.15
- Fixed in
- 8.5.15, 8.6.15
No summary published
- Affected
- >=8.0.0 <8.6.16 · >=8.7.0 <8.7.1
- Fixed in
- 8.6.16, 8.7.1
No summary published
- Affected
- >=8.0.0 <8.5.15 · >=8.6.0 <8.6.15
- Fixed in
- 8.5.15, 8.6.15
No summary published
- Affected
- >=8.0.0 <8.5.15 · >=8.6.0 <8.6.15
- Fixed in
- 8.5.15, 8.6.15
No summary published
- Affected
- >=8.0.0 <8.5.14 · >=8.6.0 <8.6.13
- Fixed in
- 8.5.14, 8.6.13
No summary published
- Affected
- >=8.0.0 <8.5.11 · >=8.6.0 <8.6.10
- Fixed in
- 8.5.11, 8.6.10
No summary published
- Affected
- >=8.0.0 <8.5.9 · >=8.6.0 <8.6.6
- Fixed in
- 8.5.9, 8.6.6
No summary published
- Affected
- >=8.0.0 <8.5.9 · >=8.6.0 <8.6.6
- Fixed in
- 8.5.9, 8.6.6
No summary published
- Affected
- >=8.0.0 <8.4.8 · >=8.5.0 <8.5.3
- Fixed in
- 8.4.8, 8.5.3
No summary published
- Affected
- >=8.0.0 <8.4.7 · >=8.5.0 <8.5.2
- Fixed in
- 8.4.7, 8.5.2
No summary published
- Affected
- >=8.0.0 <8.4.5
- Fixed in
- 8.4.5
Fixed within 8.3.x, affecting earlier releases
Drupal PECL YAML parser unsafe object handling
- Affected
- >=8.0 <8.3.4
- Fixed in
- 8.3.4
Drupal Core Remote Code Execution Vulnerability
- Affected
- >=7.0 <7.58 · >=8.0 <8.3.9 · >=8.4.0 <8.4.6 · >=8.5.0 <8.5.1
- Fixed in
- 7.58, 8.3.9, 8.4.6, 8.5.1
Drupal access control bypass vulnerability
- Affected
- >=8.0 <8.2.8 · >=8.3.0 <8.3.1
- Fixed in
- 8.2.8, 8.3.1
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
- Affected
- >=8.0 <8.3.7
- Fixed in
- 8.3.7
Drupal REST API can bypass comment approval
- Affected
- >=8.0 <8.3.7
- Fixed in
- 8.3.7
Drupal core access bypass vulnerability
- Affected
- >=7.0 <7.56 · >=8.0 <8.3.4
- Fixed in
- 7.56, 8.3.4
Drupal file REST resource does not properly validate
- Affected
- >=8.0 <8.3.4
- Fixed in
- 8.3.4
Missing Authorization in Drupal
- Affected
- >=8.0 <8.3.7
- Fixed in
- 8.3.7
No summary published
- Affected
- >=8.0.0 <8.3.9 · >=8.4.0 <8.4.6 · >=8.5.0 <8.5.1
- Fixed in
- 8.3.9, 8.4.6, 8.5.1
Which of your client projects are still on drupal/core 8.3?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact drupal/core version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other drupal/core versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.