Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence Composer

drupal/core-recommended

Core and its dependencies with known-compatible minor versions. Require this project INSTEAD OF drupal/core.

Composer latest 10.6.17 GPL-2.0-or-later

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

10.6.17

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

Critical

6 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

6
GHSA-938f-5r4f-h65v critical

Drupal core contains a potential PHP Object Injection vulnerability

Affected range

ECOSYSTEM: introduced 8.8.0; fixed 10.2.11ECOSYSTEM: introduced 10.3.0; fixed 10.3.9ECOSYSTEM: introduced 11.0.0; fixed 11.0.8>=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.8.0,<10.2.11

Fixed versions: 10.2.11, 10.3.9, 11.0.8

CVE-2024-55636 Source ↗Source ↗
GHSA-w6rx-9g2x-mg5g critical

Drupal core contains a potential PHP Object Injection vulnerability

Affected range

ECOSYSTEM: introduced 8.8.0; fixed 10.2.11ECOSYSTEM: introduced 10.3.0; fixed 10.3.9ECOSYSTEM: introduced 11.0.0; fixed 11.0.8>=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.8.0,<10.2.11

Fixed versions: 10.2.11, 10.3.9, 11.0.8

CVE-2024-55637 Source ↗Source ↗
GHSA-gvf2-2f4g-jqf4 critical

Drupal core contains a potential PHP Object Injection vulnerability

Affected range

ECOSYSTEM: introduced 8.8.0; fixed 10.2.11ECOSYSTEM: introduced 10.3.0; fixed 10.3.9ECOSYSTEM: introduced 7.0; fixed 7.102>=7.0,<7.102|>=10.3.0,<10.3.9|>=8.8.0,<10.2.11

Fixed versions: 10.2.11, 10.3.9, 7.102

CVE-2024-55638 Source ↗Source ↗
GHSA-7cwc-fjqm-8vh8 moderate

Drupal core Access bypass

Affected range

ECOSYSTEM: introduced 8.0.0; fixed 10.2.11ECOSYSTEM: introduced 10.3.0; fixed 10.3.9ECOSYSTEM: introduced 11.0.0; fixed 11.0.8>=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.0.0,<10.2.11

Fixed versions: 10.2.11, 10.3.9, 11.0.8

CVE-2024-55634 Source ↗Source ↗
GHSA-8mvq-8h2v-j9vf moderate

Drupal Core Cross-Site Scripting (XSS)

Affected range

ECOSYSTEM: introduced 8.8.0; fixed 10.2.11ECOSYSTEM: introduced 10.3.0; fixed 10.3.9ECOSYSTEM: introduced 11.0.0; fixed 11.0.8>=11.0.0,<11.0.8|>=10.3.0,<10.3.9|>=8.8.0,<10.2.11

Fixed versions: 10.2.11, 10.3.9, 11.0.8

CVE-2024-12393 Source ↗Source ↗
GHSA-mg8j-w93w-xjgc moderate

Drupal Full Path Disclosure

Affected range

ECOSYSTEM: introduced 10.3.0; fixed 10.3.6ECOSYSTEM: introduced 11.0.0; fixed 11.0.5ECOSYSTEM: introduced 8.0.0; fixed 10.2.9>=8.0.0,<10.2.9|>=10.3.0,<10.3.6|>=11.0.0,<11.0.5

Fixed versions: 10.3.6, 11.0.5, 10.2.9

CVE-2024-45440 Source ↗Source ↗