https://www.theregister.com/security/2026/05/19/drupal-warns-admins-to-brace-for-highly-critical-core-patch/5242728

This looks like a bad one. The main fault is mitigated by the fact that it only affects installs using PostgreSQL, but it appears there are others related to the underlying Symfony framework