CVE-2026-55803

score

0.1

cvss

5.9

epss

0.4%

published

2026-07-10

kev added

—

first seen

2026-10-21

Drupal core <= 10.5.12, 10.6.0 to 10.6.11, 11.0.* to 11.1.*, 11.2.0 to 11.2.14, and 11.3.0 to 11.3.12 contains an object injection vulnerability caused by improperly controlled modification of dynamically-determined object attributes, letting attackers inject malicious objects remotely, exploit requires crafted input.