Vulnerability · Published Oct 30, 2026 · Assigned by drupal
CVE-2026-108514Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
Unrated
In plain English
A cross-site scripting in Drupal core from Drupal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 90.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | drupal/core | 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2 | DRUPAL-CORE-2026-016 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Drupal | Drupal core | 10.3.0 – before 10.6.1911.0.0 – before 11.3.1911.4.0 – before 11.4.1012.0.0-alpha1 – before 12.0.0-beta2 |
Weakness: CWE-79