Live › vulnerability › CVE-2026-108514
Drupal core versions 10.3.0 through 10.6.19, 11.0.0 through 11.3.19, 11.4.0 through 11.4.10, and 12.0.0-alpha1 through 12.0.0-beta2 contain a cross-site scripting flaw. An attacker can inject script into web pages that a visitor's browser then runs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal core in the listed version ranges are exposed. The sources do not say which modules, themes, or configurations are required to trigger the flaw, so any site on an affected version should be treated as in scope until checked.
No product ranges from the sources yet.
vendor/bin/drush status drupal-version or by reading core/lib/Drupal.php.10.3.0 to 10.6.19, 11.0.0 to 11.3.19, 11.4.0 to 11.4.10, 12.0.0-alpha1 to 12.0.0-beta2.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
This page as .md · .json · in your agent: get_signal("CVE-2026-108514")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.