Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/drupal/core@10.3.14
purl pkg:composer/drupal/core@10.3.14
Next non-vulnerable version 10.4.9
Latest non-vulnerable version 11.2.8
Risk 3.1
Vulnerabilities affecting this package (4)
Vulnerability Summary Fixed by
VCID-g33x-1paw-7udm
Aliases:
CVE-2025-13081
GHSA-m6vv-vcj8-w8m7
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
10.4.9
Affected by 0 other vulnerabilities.
10.5.6
Affected by 0 other vulnerabilities.
11.1.9
Affected by 0 other vulnerabilities.
11.2.8
Affected by 0 other vulnerabilities.
VCID-hgb1-xrne-e7c8
Aliases:
CVE-2025-13080
GHSA-83v7-c2cf-p9c2
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
10.4.9
Affected by 0 other vulnerabilities.
10.5.6
Affected by 0 other vulnerabilities.
11.1.9
Affected by 0 other vulnerabilities.
11.2.8
Affected by 0 other vulnerabilities.
VCID-hwnd-nuv7-jqbh
Aliases:
CVE-2025-13082
GHSA-h89p-5896-f4q8
User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
10.4.9
Affected by 0 other vulnerabilities.
10.5.6
Affected by 0 other vulnerabilities.
11.1.9
Affected by 0 other vulnerabilities.
11.2.8
Affected by 0 other vulnerabilities.
VCID-syrg-ckq7-cbd6
Aliases:
CVE-2025-13083
GHSA-mhpg-hpj5-73r2
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.
10.4.9
Affected by 0 other vulnerabilities.
10.5.6
Affected by 0 other vulnerabilities.
11.1.9
Affected by 0 other vulnerabilities.
11.2.8
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-ed6y-c9tz-mbds Drupal Core Cross-Site Scripting (XSS) Vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. CVE-2025-31675
GHSA-m4wj-hhwj-47qp

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-12T01:14:07.716129+00:00 GitLab Importer Affected by VCID-g33x-1paw-7udm https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/drupal/core/CVE-2025-13081.yml 38.3.0
2026-04-12T01:14:05.316336+00:00 GitLab Importer Affected by VCID-syrg-ckq7-cbd6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/drupal/core/CVE-2025-13083.yml 38.3.0
2026-04-12T01:14:02.517195+00:00 GitLab Importer Affected by VCID-hgb1-xrne-e7c8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/drupal/core/CVE-2025-13080.yml 38.3.0
2026-04-12T01:13:59.349352+00:00 GitLab Importer Affected by VCID-hwnd-nuv7-jqbh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/drupal/core/CVE-2025-13082.yml 38.3.0
2026-04-12T00:44:50.427672+00:00 GitLab Importer Fixing VCID-ed6y-c9tz-mbds https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/drupal/core/CVE-2025-31675.yml 38.3.0
2026-04-07T14:17:24.380647+00:00 GithubOSV Importer Fixing VCID-ed6y-c9tz-mbds https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-m4wj-hhwj-47qp/GHSA-m4wj-hhwj-47qp.json 38.1.0
2026-04-07T04:57:27.167552+00:00 GHSA Importer Fixing VCID-ed6y-c9tz-mbds https://github.com/advisories/GHSA-m4wj-hhwj-47qp 38.1.0
2026-04-03T01:23:05.171968+00:00 GitLab Importer Affected by VCID-g33x-1paw-7udm https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/drupal/core/CVE-2025-13081.yml 38.1.0
2026-04-03T01:23:02.862191+00:00 GitLab Importer Affected by VCID-syrg-ckq7-cbd6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/drupal/core/CVE-2025-13083.yml 38.1.0
2026-04-03T01:23:00.182717+00:00 GitLab Importer Affected by VCID-hgb1-xrne-e7c8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/drupal/core/CVE-2025-13080.yml 38.1.0
2026-04-03T01:22:56.908468+00:00 GitLab Importer Affected by VCID-hwnd-nuv7-jqbh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/drupal/core/CVE-2025-13082.yml 38.1.0
2026-04-03T00:52:58.349485+00:00 GitLab Importer Fixing VCID-ed6y-c9tz-mbds https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/drupal/core/CVE-2025-31675.yml 38.1.0
2026-04-02T12:41:10.958923+00:00 GitLab Importer Fixing VCID-ed6y-c9tz-mbds https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/drupal/core/CVE-2025-31675.yml 38.0.0
2026-04-01T12:54:55.207077+00:00 GithubOSV Importer Fixing VCID-ed6y-c9tz-mbds https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-m4wj-hhwj-47qp/GHSA-m4wj-hhwj-47qp.json 38.0.0