Is drupal/core 9.4 vulnerable?
Composer · 16 releases from 9.4.0 to 9.4.15 · latest drupal/core is 11.4.11 · checked 1 Nov 2026
Yes: 46 known advisories
Yes. drupal/core 9.4.15, the last 9.4 release, is affected by 46 known security advisories (2 critical, 2 high, 10 medium, 32 low), including CVE-2026-9082, CVE-2023-5256, CVE-2024-55638. 15 more affect earlier 9.4.x releases. Upgrade to 10.6.19 or later to fix all of them.
composer require drupal/core:^10.6.19Advisories affecting drupal/core 9.4.15
No summary published
- Affected
- >=8.9.0 <10.6.19 · >=11.0.0 <11.3.19 · >=11.4.0 <11.4.10 · >=12.0.0-alpha1 <12.0.0-beta2
- Fixed in
- 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2
No summary published
- Affected
- >=8.9.0 <10.6.19 · >=11.0.0 <11.3.19 · >=11.4.0 <11.4.10 · >=12.0.0-alpha1 <12.0.0-beta2
- Fixed in
- 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2
No summary published
- Affected
- <10.6.13 · >=11.3.0 <11.3.14 · >=11.4.0 <11.4.4 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0 · >=11.2.0 <11.3.0
- Fixed in
- 10.6.13, 11.1.0, 11.2.0, 11.3.0, 11.3.14, 11.4.4
No summary published
- Affected
- <10.6.13 · >=11.3.0 <11.3.14 · >=11.4.0 <11.4.4 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0 · >=11.2.0 <11.3.0
- Fixed in
- 10.6.13, 11.1.0, 11.2.0, 11.3.0, 11.3.14, 11.4.4
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
No summary published
- Affected
- <10.5.12 · >=10.6.0 <10.6.11 · >=11.2.0 <11.2.14 · >=11.3.0 <11.3.12 · >=11.0.0 <11.1.0 · >=11.1.0 <11.2.0
- Fixed in
- 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
Drupal Core has a SQL Injection issue
- Affected
- >=8.9.0 <10.4.10 · >=10.5.0 <10.5.10 · >=10.6.0 <10.6.9 · >=11.0.0 <11.1.10 · >=11.2.0 <11.2.12 · >=11.3.0 <11.3.10
- Fixed in
- 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10
No summary published
- Affected
- >=8.9.0 <10.4.10 · >=10.5.0 <10.5.10 · >=10.6.0 <10.6.9 · >=11.0.0 <11.1.10 · >=11.2.0 <11.2.12 · >=11.3.0 <11.3.10
- Fixed in
- 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10
Drupal core is Vulnerable to Cross-Site Scripting
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
Drupal core allows Object Injection
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
No summary published
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
No summary published
- Affected
- >=8.0.0 <10.5.9 · >=10.6.0 <10.6.7 · >=11.0.0 <11.2.11 · >=11.3.0 <11.3.7
- Fixed in
- 10.5.9, 10.6.7, 11.2.11, 11.3.7
Drupal core allows Object Injection
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
Drupal core allows Forceful Browsing
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
Drupal core allows Content Spoofing
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8 · >=7.0 <7.103
- Fixed in
- 7.103, 10.4.9, 10.5.6, 11.1.9, 11.2.8
No summary published
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
No summary published
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
No summary published
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
No summary published
- Affected
- >=8.0.0 <10.4.9 · >=10.5.0 <10.5.6 · >=11.0.0 <11.1.9 · >=11.2.0 <11.2.8
- Fixed in
- 10.4.9, 10.5.6, 11.1.9, 11.2.8
Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
Drupal Core Vulnerable to Forceful Browsing
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
Drupal Core Cross-Site Scripting (XSS) Vulnerability
- Affected
- >=8.0.0 <10.3.14 · >=10.4.0 <10.4.5 · >=11.0.0 <11.0.13 · >=11.1.0 <11.1.5
- Fixed in
- 10.3.14, 10.4.5, 11.0.13, 11.1.5
No summary published
- Affected
- >=8.0.0 <10.3.14 · >=10.4.0 <10.4.5 · >=11.0.0 <11.0.13 · >=11.1.0 <11.1.5
- Fixed in
- 10.3.14, 10.4.5, 11.0.13, 11.1.5
No summary published
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
No summary published
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
No summary published
- Affected
- >=8.0.0 <10.3.13 · >=10.4.0 <10.4.3 · >=11.0.0 <11.0.12 · >=11.1.0 <11.1.3
- Fixed in
- 10.3.13, 10.4.3, 11.0.12, 11.1.3
Drupal core contains a potential PHP Object Injection vulnerability
- Affected
- >=8.8.0 <10.2.11 · >=10.3.0 <10.3.9 · >=7.0 <7.102
- Fixed in
- 7.102, 10.2.11, 10.3.9
Drupal core contains a potential PHP Object Injection vulnerability
- Affected
- >=8.8.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
Drupal core Access bypass
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
Drupal core contains a potential PHP Object Injection vulnerability
- Affected
- >=8.8.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
Drupal Core Cross-Site Scripting (XSS)
- Affected
- >=8.8.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
No summary published
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9
- Fixed in
- 10.2.11, 10.3.9
No summary published
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
No summary published
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
No summary published
- Affected
- >=8.0.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
No summary published
- Affected
- >=8.8.0 <10.2.11 · >=10.3.0 <10.3.9 · >=11.0.0 <11.0.8
- Fixed in
- 10.2.11, 10.3.9, 11.0.8
Drupal Full Path Disclosure
- Affected
- >=10.3.0 <10.3.6 · >=11.0.0 <11.0.5 · >=8.0.0 <10.2.9
- Fixed in
- 10.2.9, 10.3.6, 11.0.5
Drupal core Denial of Service vulnerability
- Affected
- >=8.0.0 <10.1.8 · >=10.2.0 <10.2.2
- Fixed in
- 10.1.8, 10.2.2
No summary published
- Affected
- >=8.0.0 <10.1.8 · >=10.2.0 <10.2.2
- Fixed in
- 10.1.8, 10.2.2
Cache poisoning in drupal/core
- Affected
- >=8.7.0 <9.5.11 · >=10.0.0 <10.0.11 · >=10.1.0 <10.1.4
- Fixed in
- 9.5.11, 10.0.11, 10.1.4
No summary published
- Affected
- >=8.7.0 <9.5.11 · >=10.0.0 <10.0.11 · >=10.1.0 <10.1.4
- Fixed in
- 9.5.11, 10.0.11, 10.1.4
Fixed within 9.4.x, affecting earlier releases
Access bypass in Drupal core
- Affected
- >=10.0.0 <10.0.8 · >=9.5.0 <9.5.8 · >=9.0.0 <9.4.14 · >=7.0.0 <7.96
- Fixed in
- 7.96, 9.4.14, 9.5.8, 10.0.8
Lack of domain validation in Druple core
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
Access bypass in Drupal Core
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.4.14 · >=9.5.0 <9.5.8 · >=10.0.0 <10.0.8
- Fixed in
- 9.4.14, 9.5.8, 10.0.8
No summary published
- Affected
- >=8.0.0 <9.4.12 · >=9.5.0 <9.5.5 · >=10.0.0 <10.0.5
- Fixed in
- 9.4.12, 9.5.5, 10.0.5
No summary published
- Affected
- >=8.0.0 <9.4.12 · >=9.5.0 <9.5.5 · >=10.0.0 <10.0.5
- Fixed in
- 9.4.12, 9.5.5, 10.0.5
No summary published
- Affected
- >=8.0.0 <9.4.12 · >=9.5.0 <9.5.5 · >=10.0.0 <10.0.5
- Fixed in
- 9.4.12, 9.5.5, 10.0.5
No summary published
- Affected
- >=8.0.0 <9.4.10 · >=9.5.0 <9.5.2 · >=10.0.0 <10.0.2
- Fixed in
- 9.4.10, 9.5.2, 10.0.2
No summary published
- Affected
- >=8.0.0 <9.3.22 · >=9.4.0 <9.4.7
- Fixed in
- 9.3.22, 9.4.7
Drupal core arbitrary PHP code execution
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
Drupal core Information Disclosure vulnerability
- Affected
- >=7.0.0 <7.91 · >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 7.91, 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
No summary published
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
Which of your client projects are still on drupal/core 9.4?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact drupal/core version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other drupal/core versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.