Known Vulnerabilities for Core by Drupal
Listed below are 10 of the newest known vulnerabilities associated with "Core" by "Drupal".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-79658 json | Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, whi... | Not Provided | 2026-08-25 | 2026-08-25 |
| CVE-2026-78676 json | GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant... | Not Provided | 2026-08-25 | 2026-08-25 |
| CVE-2026-78562 json | The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This m... | Not Provided | 2026-08-25 | 2026-08-25 |
| CVE-2026-78177 json | A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file ... | Not Provided | 2026-08-24 | 2026-08-24 |
| CVE-2026-77923 json | Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the p... | Not Provided | 2026-08-24 | 2026-08-24 |
| CVE-2026-77915 json | rConfig Core 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to sel... | Not Provided | 2026-08-24 | 2026-08-25 |
| CVE-2026-77914 json | rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary fi... | Not Provided | 2026-08-24 | 2026-08-25 |
| CVE-2026-77643 json | A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before ... | Not Provided | 2026-08-20 | 2026-08-20 |
| CVE-2026-76841 json | Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no... | Not Provided | 2026-08-24 | 2026-08-24 |
| CVE-2026-76837 json | Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ ... | Not Provided | 2026-08-24 | 2026-08-24 |