CVE-2026-110738

Keine CWE-Zuordnung erfasst.

• Open Source Drupal≤ Gin Admin Theme <4.1.4cert_bundDE
• Open Source Drupal≤ Gin Admin Theme <5.0.16cert_bundDE
• Open Source Open Source Drupal Gin Admin Theme <4.1.4≤ Gin Admin Theme <4.1.4cert_bundDE
• Open Source Open Source Drupal Gin Admin Theme <5.0.16≤ Gin Admin Theme <5.0.16cert_bundDE
• Drupal core≤ vers:unknown/*ncsc_nlNL
• drupal entity_list≤ vers:unknown/*ncsc_nlNL
• drupal gin≤ vers:unknown/*ncsc_nlNL
• Packagist:https://packages.drupal.org/8 drupal/gin< 4.1.4osvUSpkg:composer/drupal/gin?repository_url=https:%2F%2Fpackages.drupal.org%2F8
• Packagist:https://packages.drupal.org/8 drupal/gin5.0.0 → 5.0.16osvUSpkg:composer/drupal/gin?repository_url=https:%2F%2Fpackages.drupal.org%2F8

• NCSC-2026-0438Kwetsbaarheden verholpen in Drupal Core en modules door DrupalNL2026-10-19csaf · ncsc_nlNL

  Drupal heeft kwetsbaarheden verholpen in de Drupal core Field UI module, Entity List module, Navigation module, Link module en het Gin administratie thema.

• WID-SEC-W-2026-3968Drupal Core, Gin Admin Theme und Entity List: Mehrere SchwachstellenDeutsch2026-10-14csaf · cert_bundDE

  Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen oder Cross-Site-Scripting-Angriffe durchzuführen.

• DRUPAL-CONTRIB-2026-2192026-10-14vendor · osvUS

  Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators. The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.