CVE-2026-108514
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
| CWE | CWE-79 |
| Vendor | drupal |
| Product | drupal core |
| Ecosystems | |
| Industries | WebMedia |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for drupal drupal core
Be the first to know when new unknown vulnerabilities affecting drupal drupal core are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Drupal / Drupal core
10.3.0 < 10.6.19 11.0.0 < 11.3.19 11.4.0 < 11.4.10 12.0.0-alpha1 < 12.0.0-beta2
Credits
Eric Tee (erictee2802) haii haii (hai27ii2o) C Huaruu (huarui) Benji Fisher (benjifisher) Jürgen Haas (jurgenhaas) Lee Rowlands (larowlan) Mingsong (mingsong) Mohit Aghera (mohit_aghera) James Gilliland (neclimdul) Pablo López (plopesc) Juraj Nemec (poker10) Pierre Rudloff (prudloff) cilefen (cilefen) Lee Rowlands (larowlan) Dave Long (longwave) James Gilliland (neclimdul) Juraj Nemec (poker10) Pierre Rudloff (prudloff) Jess (xjm)