CVE-2026-55807

score

<0.1

cvss

3.1

epss

0.2%

published

2026-07-10

kev added

—

first seen

2026-10-21

Drupal Drupal core < 10.5.13, 10.6.0 < 10.6.12, 11.2.0 < 11.2.15, 11.3.0 < 11.3.13, and < 11.2.* contains a server side request forgery caused by improper validation of URLs, letting attackers make arbitrary requests from the server, exploit requires network access.