{"id":"drupal-security-c6334a6d8e4c","seq":2014,"kind":"advisory","title":"Drupal core - Highly critical - SQL injection - SA-CORE-2026-004","url":"https://www.drupal.org/sa-core-2026-004","permalink":"https://vulnpulse.app/items/drupal-security-c6334a6d8e4c","summary":"Project: Drupal core Project machine name: drupal Date: 2026-May-20 Security risk: Highly critical 23 ∕ 25 AC:None/A:None/CI:All/II:All/E:Exploit/TD:Uncommon Vulnerability: SQL injection Affected versions: >= 8.9.0 < 10.4.10 || >= 10.5.0 < 10.5.10 || >= 10.6.0 < 10.6.9 || >= 11.0.0 < 11.1.10 || >= 11.2.0 < 11.2.12 || >= 11.3.0 < 11.3.10 CVE IDs: CVE-2026-9082 Description: Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted re…","severity":"critical","techs":["drupal","php"],"cves":["CVE-2026-9082"],"tags":["security"],"source":{"id":"drupal-security","name":"Drupal Security Advisories"},"published_at":"2026-05-20T18:08:21.000Z","fetched_at":"2026-10-21T16:17:45.699Z"}