CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

[NEW] [medium] Drupal Core: Multiple vulnerabilities

mediumCVE-2026-15916CVE-2026-15917CVE-2026-55805
A remote, anonymous attacker can exploit multiple vulnerabilities in Drupal Core to disclose information or perform a Cross Site Scripting attack.

CSIRTS triage

vendor: Drupalproduct: CoreInformation disclosureCross-site scripting
What
Multiple vulnerabilities can be exploited to disclose information or perform Cross Site Scripting attacks.
Who is affected
Remote, anonymous attackers targeting Drupal Core installations.
Urgency
Remediation is important as these vulnerabilities can be exploited by anonymous attackers.
Action
Update to the latest version of Drupal Core.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Core

Get an email when a new Core advisory drops — max one per day, one-click unsubscribe.

Details

Source
CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity
medium
Published
2026-07-16
Exploitation
Not in CISA KEV at last sync
Language
Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2372

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2026-15916coverage & exploitation statusNVD · CVE.org
CVE-2026-15917coverage & exploitation statusNVD · CVE.org
CVE-2026-55805coverage & exploitation statusNVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Drupal Core

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

More from CERT-Bund (BSI) Security Advisories