{"id":"CVE-2026-108514","published":"2026-10-30T03:09:51Z","modified":"2026-10-30T03:09:51Z","title":"Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016","vendor":"Drupal","product":"Drupal core","tier":"tail","description":{"text":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00197,"percentile":0.09468,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://www.drupal.org/sa-core-2026-016","tags":[]}],"priority":{"score":1.9,"factors":[{"name":"EPSS percentile","points":1.89}]},"vendorSlug":"drupal","affectedVersions":[{"vendor":"Drupal","product":"Drupal core","versions":[">= 10.3.0, < 10.6.19",">= 11.0.0, < 11.3.19",">= 11.4.0, < 11.4.10",">= 12.0.0-alpha1, < 12.0.0-beta2"]}],"affected":[{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=10.3.0, <10.6.19",">=11.0.0, <11.3.19",">=11.4.0, <11.4.10",">=12.0.0-alpha1, <12.0.0-beta2"],"patched":["10.6.19","11.3.19","11.4.10","12.0.0-beta2"],"from":["DRUPAL-CORE-2026-016"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-113554","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-drupal-core-cve-2026-55805","packageHistory":[{"cve":"CVE-2026-15917","published":"2026-08-25","fixed":"11.4.4","kev":false},{"cve":"CVE-2026-55805","published":"2026-08-25","fixed":"11.4.4","kev":false,"link":{"from":"CVE-2026-55805","to":"CVE-2026-108514","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"10.6.13","toFixed":"10.6.19","daysApart":66},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"11.3.14","toFixed":"11.3.19","daysApart":66},{"kind":"similar","provenance":"machine","score":0.6,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2026-108097","published":"2026-10-30","fixed":"12.0.0-beta2","kev":false},{"cve":"CVE-2026-108514","published":"2026-10-30","fixed":"12.0.0-beta2","kev":false},{"cve":"CVE-2026-108515","published":"2026-10-30","fixed":"12.0.0-beta2","kev":false}],"package":"Packagist:drupal/core"}}