feat: update advisories (#217)

🤖 beep boop - looks like there's some changes to the advisories!

- https://www.drupal.org/SA-CORE-2026-004

Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>

Author: DrupalSecurityBot

advisories/core/DRUPAL-CORE-2026-004.json

@@ -0,0 +1,122 @@
+{
+  "schema_version": "1.7.0",
+  "id": "DRUPAL-CORE-2026-004",
+  "modified": "2026-05-20T18:08:21.000Z",
+  "published": "2026-05-20T18:08:21.000Z",
+  "aliases": [
+    "CVE-2026-9082"
+  ],
+  "details": "Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks.\n\nA vulnerability in this API allows an attacker to send specially crafted requests, resulting in arbitrary SQL injection for sites using PostgreSQL databases. This can lead to information disclosure, and in some cases privilege escalation, remote code execution, or other attacks.\n\nThis vulnerability can be exploited by anonymous users.\n\nThis vulnerability **only affects sites using PostgreSQL**. However, the dependency updates in this release apply to all sites.\n\n### Upstream security advisories\n\nThe Drupal releases for supported branches (11.3, 11.2, 10.6, and 10.5) in this advisory also include security updates for Symfony and Twig. Those projects have released important [Security Advisories](https://symfony.com/blog/category/security-advisories) that were coordinated with this Drupal release, and Drupal is affected by some of the vulnerabilities.\n\nDepending on your site configuration and contrib modules, you may be vulnerable to one or more of these upstream issues, so **updating these dependencies is highly recommended whether the SQL Injection vulnerability affects you or not**. It is also recommended to review which user roles have the ability to update Twig templates, for example via Views or contributed modules.",
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/core"
+      },
+      "severity": [],
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.9.0"
+            },
+            {
+              "fixed": "10.4.10"
+            }
+          ],
+          "database_specific": {
+            "constraint": ">= 8.9.0 < 10.4.10"
+          }
+        },
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "10.5.0"
+            },
+            {
+              "fixed": "10.5.10"
+            }
+          ],
+          "database_specific": {
+            "constraint": ">= 10.5.0 < 10.5.10"
+          }
+        },
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "10.6.0"
+            },
+            {
+              "fixed": "10.6.9"
+            }
+          ],
+          "database_specific": {
+            "constraint": ">= 10.6.0 < 10.6.9"
+          }
+        },
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "11.0.0"
+            },
+            {
+              "fixed": "11.1.10"
+            }
+          ],
+          "database_specific": {
+            "constraint": ">= 11.0.0 < 11.1.10"
+          }
+        },
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "11.2.0"
+            },
+            {
+              "fixed": "11.2.12"
+            }
+          ],
+          "database_specific": {
+            "constraint": ">= 11.2.0 < 11.2.12"
+          }
+        },
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "11.3.0"
+            },
+            {
+              "fixed": "11.3.10"
+            }
+          ],
+          "database_specific": {
+            "constraint": ">= 11.3.0 < 11.3.10"
+          }
+        }
+      ],
+      "database_specific": {
+        "affected_versions": ">= 8.9.0 < 10.4.10 || >= 10.5.0 < 10.5.10 || >= 10.6.0 < 10.6.9 || >= 11.0.0 < 11.1.10 || >= 11.2.0 < 11.2.12 || >= 11.3.0 < 11.3.10"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://www.drupal.org/sa-core-2026-004"
+    }
+  ],
+  "credits": [
+    {
+      "name": "Michael Maturi (michaelmaturi)",
+      "contact": [
+        "https://www.drupal.org/u/michaelmaturi"
+      ]
+    }
+  ]
+}