# Drupal 10.3.14: actively exploited

Attackers are using a vulnerability in this version right now. Upgrade immediately.

- Recommended: 11.3.20 (lowest fixed release that is still supported)
- Known vulnerabilities: 18 (1 critical, 0 high, 12 medium, 2 low)
- End of life: yes, since 2025-06-16 (release line 10.3)
- Data as of: 2026-10-24 19:22 UTC

## Vulnerabilities

| ID | Severity | Actively exploited | Fixed in |
|---|---|---|---|
| [CVE-2026-9082](https://www.drupal.org/sa-core-2026-004) | critical | yes | 10.4.10 |
| [CVE-2026-6366](https://www.drupal.org/sa-core-2026-002) | medium | no | 10.5.9 |
| [CVE-2026-6365](https://www.drupal.org/sa-core-2026-001) | medium | no | 10.5.9 |
| [CVE-2026-55806](https://www.drupal.org/sa-core-2026-007) | medium | no | 11.2.14 |
| [CVE-2026-55804](https://www.drupal.org/sa-core-2026-006) | medium | no | 11.2.14 |
| [CVE-2026-55803](https://www.drupal.org/sa-core-2026-005) | medium | no | 11.2.14 |
| [CVE-2025-13081](https://www.drupal.org/sa-core-2025-006) | medium | no | 10.4.9 |
| [CVE-2026-55808](https://www.drupal.org/sa-core-2026-009) | medium | no | 11.2.14 |
| [CVE-2026-55805](https://www.drupal.org/sa-core-2026-012) | medium | no | 11.3.14 |
| [CVE-2025-13080](https://www.drupal.org/sa-core-2025-005) | medium | no | 10.4.9 |

And 8 more with lower severity.

Installed with apt, yum or another package manager? Your distribution may already have patched this without changing the version, so check its security tracker too.

---

FixedIn gives information, not guarantees. Always confirm with the vendor's advisory before you rely on a result. Source: https://fixedin.dev/drupal/10.3.14 · JSON: https://fixedin.dev/drupal/10.3.14.json · MCP server: https://fixedin.dev/mcp · About these addresses: https://fixedin.dev/llms.txt