CVE-2026-108515

No weakness (CWE) mapping recorded.

• Open Source Drupal≤ Core <11.4.10cert_bundDE
• Open Source Drupal≤ Core <12.0.0-beta2cert_bundDE
• Open Source Drupal≤ Core <10.6.19cert_bundDE
• Open Source Drupal≤ Core <11.3.19cert_bundDE
• Open Source Open Source Drupal Core <10.6.19≤ Core <10.6.19cert_bundDE
• Open Source Open Source Drupal Core <11.3.19≤ Core <11.3.19cert_bundDE
• Open Source Open Source Drupal Core <11.4.10≤ Core <11.4.10cert_bundDE
• Open Source Open Source Drupal Core <12.0.0-beta2≤ Core <12.0.0-beta2cert_bundDE
• Drupal core≤ vers:unknown/*ncsc_nlNL
• drupal entity_list≤ vers:unknown/*ncsc_nlNL
• drupal gin≤ vers:unknown/*ncsc_nlNL
• Packagist drupal/core11.0.0 → 11.3.19osvUSpkg:composer/drupal/core
• Packagist drupal/core11.4.0 → 11.4.10osvUSpkg:composer/drupal/core
• Packagist drupal/core12.0.0-alpha1 → 12.0.0-beta2osvUSpkg:composer/drupal/core
• Packagist drupal/core8.9.0 → 10.6.19osvUSpkg:composer/drupal/core

• NCSC-2026-0438Kwetsbaarheden verholpen in Drupal Core en modules door DrupalNL2026-10-19csaf · ncsc_nlNL

  Drupal heeft kwetsbaarheden verholpen in de Drupal core Field UI module, Entity List module, Navigation module, Link module en het Gin administratie thema.

• WID-SEC-W-2026-3968Drupal Core, Gin Admin Theme und Entity List: Mehrere SchwachstellenDeutsch2026-10-14csaf · cert_bundDE

  Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen oder Cross-Site-Scripting-Angriffe durchzuführen.

• CERTFR-2026-AVI-1321Multiples vulnérabilités dans DrupalFrançais2026-10-15vendor · certfrFR
• DRUPAL-CORE-2026-0152026-10-14vendor · osvUS

  The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.