CVE-2026-108514
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
Exploit likelihood
What each source reports
CVE List No score
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
- Record
CVE-2026-108514- Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-113554 No score
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
- Record
EUVD-2026-113554- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8pmv-83q8-mcx5 No score
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")...
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
- Record
GHSA-8pmv-83q8-mcx5- Weakness
- CWE-79
- Updated
- 2026-11-02
NVD No score
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
- Record
CVE-2026-108514- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVCLSA-2026-1792527484 No score
TuxCare security update for drupal/core (3 CVEs)
TuxCare rebuilt drupal/core to address 3 CVEs. Fixed in 10.6.17-p1+tuxcare.
- Record
CLSA-2026-1792527484- Updated
- 2026-11-02
OSVCLSA-2026-1792527640 No score
TuxCare security update for drupal/core (3 CVEs)
TuxCare rebuilt drupal/core to address 3 CVEs. Fixed in 10.5.12-p2+tuxcare.
- Record
CLSA-2026-1792527640- Updated
- 2026-11-02
OSV No score
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
- Record
CVE-2026-108514- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDRUPAL-CORE-2026-016 No score
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.
- Record
DRUPAL-CORE-2026-016- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/coreTuxCare:Packagist |
10.6.17 up to 10.6.17-p1+tuxcare | 10.6.17-p1+tuxcare |
drupal/coreTuxCare:Packagist |
10.5.12 up to 10.5.12-p2+tuxcare, plus listed versions 10.5.12-p1+tuxcare |
10.5.12-p2+tuxcare |
drupal/corePackagist |
10.3.0 up to 10.6.19, 11.0.0 up to 11.3.19, 11.4.0 up to 11.4.10, 12.0.0-alpha1 up to 12.0.0-beta2, plus listed versions 10.3.110.3.1010.3.1110.3.1210.3.13 Show 45 moreShow less10.3.1410.3.210.3.310.3.410.3.510.3.610.3.710.3.810.3.910.4.010.4.0-beta110.4.0-rc110.4.110.4.1010.4.210.4.310.4.410.4.510.4.610.4.710.4.810.4.910.5.010.5.0-beta110.5.0-rc110.5.110.5.1010.5.1110.5.1210.5.210.5.310.5.410.5.510.5.610.5.710.5.810.5.910.6.010.6.0-beta110.6.0-rc110.6.110.6.1010.6.1110.6.1210.6.13 |
10.6.1911.3.1911.4.1012.0.0-beta2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-108514 is a vulnerability with no CVSS score yet in Drupal Core, published October 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in drupal/core 10.6.17-p1+tuxcare.
References
Left out here: 90 versions. The JSON record has them.