Drupal Security Updates – 21 May 2026

The addressed vulnerabilities could allow the attacker to conduct cross-site scripting attacks, obtain sensitive information, escalate privileges, manipulate data, execute arbitrary SQL commands, and gain access to the affected products.

Samples of the addressed vulnerabilities:

1. Drupal Date iCal Information Disclosure Vulnerability (CVE-2026-8495):

• CVSS: 9.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Obtain Information

2. Drupal Core SQL Injection Vulnerability (CVE-2026-9082):

• CVSS: 6.5
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Access

The affected products:

• Drupal core.
• Drupal Date iCal.
• Drupal Colorbox Inline.
• Translate Drupal with GTranslate.
• Drupal Node View Permissions.