{"history":[{"alert":0,"cve":"CVE-2026-55803","id":23393,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.00353, \"percentile\": 0.29356}"},{"alert":0,"cve":"CVE-2026-55803","id":20874,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.00353, \"percentile\": 0.29207}"},{"alert":0,"cve":"CVE-2026-55803","id":18718,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.00353, \"percentile\": 0.29155}"},{"alert":0,"cve":"CVE-2026-55803","id":16789,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.00353, \"percentile\": 0.29136}"},{"alert":0,"cve":"CVE-2026-55803","id":14767,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.00353, \"percentile\": 0.29109}"},{"alert":0,"cve":"CVE-2026-55803","id":12556,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.00353, \"percentile\": 0.29071}"},{"alert":0,"cve":"CVE-2026-55803","id":10541,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.00353, \"percentile\": 0.29063}"},{"alert":0,"cve":"CVE-2026-55803","id":8093,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.00353, \"percentile\": 0.29061}"},{"alert":0,"cve":"CVE-2026-55803","id":5876,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.00353, \"percentile\": 0.28967}"},{"alert":0,"cve":"CVE-2026-55803","id":3569,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.00353, \"percentile\": 0.28919}"},{"alert":1,"cve":"CVE-2026-55803","id":1781,"kind":"cna","observed_at":1793665375,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N\", \"version\": \"3.1\"}}, {\"other\": {\"content\": {\"id\": \"CVE-2026-55803\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-07-13T18:23:53.103260Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-07-13T18:24:17.938Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"collectionURL\": \"https://www.drupal.org/project/drupal\", \"product\": \"Drupal core\", \"repo\": \"https://git.drupalcode.org/project/drupal\", \"vendor\": \"Drupal\", \"versions\": [{\"lessThan\": \"10.5.12\", \"status\": \"affected\", \"version\": \"0.0.0\", \"versionType\": \"semver\"}, {\"lessThan\": \"10.6.11\", \"status\": \"affected\", \"version\": \"10.6.0\", \"versionType\": \"semver\"}, {\"lessThan\": \"11.2.14\", \"status\": \"affected\", \"version\": \"11.2.0\", \"versionType\": \"semver\"}, {\"lessThan\": \"11.3.12\", \"status\": \"affected\", \"version\": \"11.3.0\", \"versionType\": \"semver\"}, {\"lessThan\": \"11.0.*\", \"status\": \"affected\", \"version\": \"0.0.0\", \"versionType\": \"semver\"}, {\"lessThan\": \"11.1.*\", \"status\": \"affected\", \"version\": \"0.0.0\", \"versionType\": \"semver\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Michael Maturi (michaelmaturi)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Bj\\u00c3\\u00b6rn Brala (bbrala)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Sascha Grossenbacher (berdir)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Lee Rowlands (larowlan)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Dave Long (longwave)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Drew Webber (mcdruid)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Anna Kalata (akalata)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Benji Fisher (benjifisher)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Damien McKenna (damienmckenna)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"David Strauss (david strauss)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Neil Drumm (drumm)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Greg Knaddison (greggles)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Tim Hestenes Lehnen (hestenet)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Lee Rowlands (larowlan)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Dave Long (longwave)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Drew Webber (mcdruid)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Juraj Nemec (poker10)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Ra M\\u00c3\\u00a4nd (ram4nd)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Jess  (xjm)\"}], \"datePublic\": \"2026-06-17T18:56:50.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.\"}], \"impacts\": [{\"capecId\": \"CAPEC-586\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-586 Object Injection\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-915\", \"description\": \"CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-07-10T21:46:38.051Z\", \"orgId\": \"2c85b837-eb8b-40ed-9d74-228c62987387\", \"shortName\": \"drupal\"}, \"references\": [{\"url\": \"https://www.drupal.org/sa-core-2026-005\"}], \"title\": \"Drupal core - Critical - PHP object injection - SA-CORE-2026-005\"}}, \"cveMetadata\": {\"assignerOrgId\": \"2c85b837-eb8b-40ed-9d74-228c62987387\", \"assignerShortName\": \"drupal\", \"cveId\": \"CVE-2026-55803\", \"datePublished\": \"2026-07-10T21:46:38.051Z\", \"dateReserved\": \"2026-06-17T14:59:52.673Z\", \"dateUpdated\": \"2026-07-13T18:24:17.938Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"}],"record":{"affected":[{"collectionURL":"https://www.drupal.org/project/drupal","product":"Drupal core","repo":"https://git.drupalcode.org/project/drupal","vendor":"Drupal","versions":[{"lessThan":"10.5.12","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"10.6.11","status":"affected","version":"10.6.0","versionType":"semver"},{"lessThan":"11.2.14","status":"affected","version":"11.2.0","versionType":"semver"},{"lessThan":"11.3.12","status":"affected","version":"11.3.0","versionType":"semver"},{"lessThan":"11.0.*","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"11.1.*","status":"affected","version":"0.0.0","versionType":"semver"}]}],"cna":{"containers":{"adp":[{"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-55803","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-07-13T18:23:53.103260Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-07-13T18:24:17.938Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://www.drupal.org/project/drupal","product":"Drupal core","repo":"https://git.drupalcode.org/project/drupal","vendor":"Drupal","versions":[{"lessThan":"10.5.12","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"10.6.11","status":"affected","version":"10.6.0","versionType":"semver"},{"lessThan":"11.2.14","status":"affected","version":"11.2.0","versionType":"semver"},{"lessThan":"11.3.12","status":"affected","version":"11.3.0","versionType":"semver"},{"lessThan":"11.0.*","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"11.1.*","status":"affected","version":"0.0.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Michael Maturi (michaelmaturi)"},{"lang":"en","type":"remediation developer","value":"Bj\u00c3\u00b6rn Brala (bbrala)"},{"lang":"en","type":"remediation developer","value":"Sascha Grossenbacher (berdir)"},{"lang":"en","type":"remediation developer","value":"Lee Rowlands (larowlan)"},{"lang":"en","type":"remediation developer","value":"Dave Long (longwave)"},{"lang":"en","type":"remediation developer","value":"Drew Webber (mcdruid)"},{"lang":"en","type":"coordinator","value":"Anna Kalata (akalata)"},{"lang":"en","type":"coordinator","value":"Benji Fisher (benjifisher)"},{"lang":"en","type":"coordinator","value":"Damien McKenna (damienmckenna)"},{"lang":"en","type":"coordinator","value":"David Strauss (david strauss)"},{"lang":"en","type":"coordinator","value":"Neil Drumm (drumm)"},{"lang":"en","type":"coordinator","value":"Greg Knaddison (greggles)"},{"lang":"en","type":"coordinator","value":"Tim Hestenes Lehnen (hestenet)"},{"lang":"en","type":"coordinator","value":"Lee Rowlands (larowlan)"},{"lang":"en","type":"coordinator","value":"Dave Long (longwave)"},{"lang":"en","type":"coordinator","value":"Drew Webber (mcdruid)"},{"lang":"en","type":"coordinator","value":"Juraj Nemec (poker10)"},{"lang":"en","type":"coordinator","value":"Ra M\u00c3\u00a4nd (ram4nd)"},{"lang":"en","type":"coordinator","value":"Jess  (xjm)"}],"datePublic":"2026-06-17T18:56:50.000Z","descriptions":[{"lang":"en","value":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*."}],"impacts":[{"capecId":"CAPEC-586","descriptions":[{"lang":"en","value":"CAPEC-586 Object Injection"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-915","description":"CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-10T21:46:38.051Z","orgId":"2c85b837-eb8b-40ed-9d74-228c62987387","shortName":"drupal"},"references":[{"url":"https://www.drupal.org/sa-core-2026-005"}],"title":"Drupal core - Critical - PHP object injection - SA-CORE-2026-005"}},"cveMetadata":{"assignerOrgId":"2c85b837-eb8b-40ed-9d74-228c62987387","assignerShortName":"drupal","cveId":"CVE-2026-55803","datePublished":"2026-07-10T21:46:38.051Z","dateReserved":"2026-06-17T14:59:52.673Z","dateUpdated":"2026-07-13T18:24:17.938Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-55803","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.","epss":{"date":"2026-11-12","epss":0.00353,"percentile":0.29356},"epss_checked":1794522003,"first_seen":1793665374,"kev":null,"kev_checked":1794522003,"products":"Drupal Drupal core","references":["https://www.drupal.org/sa-core-2026-005"],"score":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","provider":"CISA-ADP","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Drupal core - Critical - PHP object injection - SA-CORE-2026-005","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://cloud.google.com/blog/topics/threat-intelligence/staying-ahead-of-adversarial-ai-through-agentic-source-code-review/","id":128,"publisher":"Google Threat Intelligence","title":"Staying Ahead of Adversarial AI Through Agentic Source Code Review"}]}