duke42 Security scan & fix Ongoing care
← Back to Duke42

DRUPAL REPAIR & SECURITY

Fix Drupal. Protect the content behind it.

We check core, contributed modules and the server, then verify that editing, access and key site functions still work.

See recent security issues ↓

One-time repair

FIX NOW

Previously €199 Now €99 / one-time repair

Core and module inventory · Backup · Compatible updates · Editing and access checks

Money-back guarantee. If we can’t fix your problem, we’ll refund your payment in full. Prices in EUR; VAT added where applicable.

FREE WEBSITE CHECK

Find your website’s security risks

Recent security issues

4 selected records

24 Jul 2026 – 24 Oct 2026 · Sources checked 24 Oct 2026

Drupal core advisories published in the period. Contributed modules have separate advisories and are checked against your installed inventory. This is a selected list, not a complete vulnerability inventory or a scan of your system.

Published

SA-CORE-2026-014 · CVE-2026-108097

Field UI code execution

Some contributed modules or custom code expose a core code-execution flaw; one known path needs no login.

Affected systems & fix
Applies to
Field UI installed with an exploitable contributed module or custom integration; core alone is not directly exploitable.
What fixes it
Fixed stable releases: 10.6.19, 11.3.19 and 11.4.10. Match the installed supported branch.
Official source ↗
Published

SA-CORE-2026-015 · CVE-2026-108515

Link-field cross-site scripting

Insufficient markup sanitization can allow scripts to run.

Affected systems & fix
Applies to
Affected Link module code and relevant content inputs.
What fixes it
Fixed stable releases: 10.6.19, 11.3.19 and 11.4.10. Match the installed supported branch.
Official source ↗
Published

SA-CORE-2026-016 · CVE-2026-108514

Navigation attribute scripting

Certain HTML attributes are not adequately sanitized.

Affected systems & fix
Applies to
An attacker needs permission to insert specific HTML attributes or administer menus.
What fixes it
Fixed stable releases: 10.6.19, 11.3.19 and 11.4.10. Match the installed supported branch.
Official source ↗
Published

SA-CORE-2026-013

CKEditor dependency cross-site scripting

Malicious content can target users opening the WYSIWYG editor.

Affected systems & fix
Applies to
Drupal configured with affected CKEditor integration.
What fixes it
Fixed in 10.6.17, 11.3.17 and 11.4.7; install the later supported security release for your branch.
Official source ↗

Not sure which issues affect you?

Send the site or server address and a working contact. We’ll check the installed versions and configuration before making changes. Missing access? Tell us what you have.

Keep it maintained afterwards. Care from €29/month ↗

LET’S GET IT WORKING

What happened?

Tell us what happened and how to reach you. We’ll arrange access separately — don’t share passwords here.

Can’t access it or don’t know the address? You can still ask for help.

Use another email or your phone if your website’s email is down.

Add details or available access optional

We’ll use your details to respond to this request. Access credentials are arranged separately.