Drupal 9.4

Vulnerabilities in Drupal 9.4

31 vulnerabilities from the NVD affect at least one version of this branch. Last checked on 03/11/2026.

• CVE-2026-9082, CVSS 3.1: 9.8, actively exploited: still open in 9.4.15
• CVE-2024-55638, CVSS 3.1: 9.8: still open in 9.4.15
• CVE-2024-55637, CVSS 3.1: 9.8: still open in 9.4.15
• CVE-2024-55636, CVSS 3.1: 9.8: still open in 9.4.15
• CVE-2024-55634, CVSS 3.1: 8.1: still open in 9.4.15
• CVE-2025-31674, CVSS 3.1: 7.5: still open in 9.4.15
• CVE-2024-11941, CVSS 3.1: 7.5: still open in 9.4.15
• CVE-2023-5256, CVSS 3.1: 7.5: still open in 9.4.15
• CVE-2026-6366, CVSS 3.1: 6.6: still open in 9.4.15
• CVE-2026-6365, CVSS 3.1: 6.1: still open in 9.4.15
• CVE-2025-3057, CVSS 3.1: 6.1: still open in 9.4.15
• CVE-2026-55806, CVSS 3.1: 5.9: still open in 9.4.15
• CVE-2026-55804, CVSS 3.1: 5.9: still open in 9.4.15
• CVE-2026-55803, CVSS 3.1: 5.9: still open in 9.4.15
• CVE-2025-13081, CVSS 3.1: 5.9: still open in 9.4.15
• CVE-2026-55808, CVSS 3.1: 5.4: still open in 9.4.15
• CVE-2025-31675, CVSS 3.1: 5.4: still open in 9.4.15
• CVE-2024-12393, CVSS 3.1: 5.4: still open in 9.4.15
• CVE-2025-13080, CVSS 3.1: 5.3: still open in 9.4.15
• CVE-2025-31673, CVSS 3.1: 4.6: still open in 9.4.15
• CVE-2025-13082, CVSS 3.1: 4.3: still open in 9.4.15
• CVE-2025-13083, CVSS 3.1: 3.7: still open in 9.4.15
• CVE-2026-55807, CVSS 3.1: 3.1: still open in 9.4.15
• CVE-2022-39261, CVSS 3.1: 7.5: fixed in 9.4.7
• CVE-2022-31043, CVSS 3.1: 7.5: not affected in 9.4.15
• CVE-2022-31042, CVSS 3.1: 7.5: not affected in 9.4.15
• CVE-2022-25275, CVSS 3.1: 7.5: fixed in 9.4.3
• CVE-2022-25277, CVSS 3.1: 7.2: fixed in 9.4.3
• CVE-2023-31250, CVSS 3.1: 6.5: fixed in 9.4.14
• CVE-2022-25278, CVSS 3.1: 6.5: fixed in 9.4.3
• CVE-2022-25276, CVSS 3.1: 6.1: fixed in 9.4.3

462 vulnerabilities of Drupal have no version information in the NVD and are not assigned to any branch.