CVE-2026-108515
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
Exploit likelihood
What each source reports
CVE List No score
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
- Record
CVE-2026-108515- Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-113555 No score
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
- Record
EUVD-2026-113555- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-297f-h4fx-vc6c No score
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")...
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
- Record
GHSA-297f-h4fx-vc6c- Weakness
- CWE-79
- Updated
- 2026-11-02
NVD No score
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
- Record
CVE-2026-108515- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVCLSA-2026-1792527484 No score
TuxCare security update for drupal/core (3 CVEs)
TuxCare rebuilt drupal/core to address 3 CVEs. Fixed in 10.6.17-p1+tuxcare.
- Record
CLSA-2026-1792527484- Updated
- 2026-11-02
OSVCLSA-2026-1792527640 No score
TuxCare security update for drupal/core (3 CVEs)
TuxCare rebuilt drupal/core to address 3 CVEs. Fixed in 10.5.12-p2+tuxcare.
- Record
CLSA-2026-1792527640- Updated
- 2026-11-02
OSVCLSA-2026-1792529137 No score
TuxCare security update for drupal/core (2 CVEs)
TuxCare rebuilt drupal/core to address 2 CVEs. Fixed in 8.9.20-p8+tuxcare.
- Record
CLSA-2026-1792529137- Updated
- 2026-11-02
OSV No score
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
- Record
CVE-2026-108515- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDRUPAL-CORE-2026-015 No score
The Drupal core Link module provides a field type that can be used for internal and external URLs.
The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.
- Record
DRUPAL-CORE-2026-015- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/coreTuxCare:Packagist |
10.6.17 up to 10.6.17-p1+tuxcare | 10.6.17-p1+tuxcare |
drupal/coreTuxCare:Packagist |
10.5.12 up to 10.5.12-p2+tuxcare, plus listed versions 10.5.12-p1+tuxcare |
10.5.12-p2+tuxcare |
drupal/coreTuxCare:Packagist |
8.9.20 up to 8.9.20-p8+tuxcare, plus listed versions 8.9.20-p1+tuxcare8.9.20-p2+tuxcare8.9.20-p3+tuxcare8.9.20-p4+tuxcare8.9.20-p5+tuxcare8.9.20-p6+tuxcare8.9.20-p7+tuxcare |
8.9.20-p8+tuxcare |
drupal/corePackagist |
8.9.0 up to 10.6.19, 11.0.0 up to 11.3.19, 11.4.0 up to 11.4.10, 12.0.0-alpha1 up to 12.0.0-beta2, plus listed versions 10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4 Show 45 moreShow less10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.1110.2.1210.2.210.2.310.2.410.2.510.2.610.2.7 |
10.6.1911.3.1911.4.1012.0.0-beta2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-108515 is a vulnerability with no CVSS score yet in Drupal Core, published October 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in drupal/core 10.6.17-p1+tuxcare.
References
Left out here: 298 versions. The JSON record has them.