{"id":"CVE-2026-6365","published":"2026-05-19T22:27:21Z","modified":"2026-05-20T13:35:14Z","title":"Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001","vendor":"Drupal","product":"Drupal core","tier":"tail","description":{"text":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).\n\nThis issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00219,"percentile":0.12386,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://www.drupal.org/sa-core-2026-001","tags":[]}],"priority":{"score":6.7,"factors":[{"name":"EPSS percentile","points":2.48},{"name":"CVSS severity","points":4.27}]},"vendorSlug":"drupal","affectedVersions":[{"vendor":"Drupal","product":"Drupal core","versions":[">= 8.0.0, < 10.5.9",">= 10.6.0, < 10.6.7",">= 11.0.0, < 11.2.11",">= 11.3.0, < 11.3.7"]}],"affected":[{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.0.0, <10.5.9",">=10.6.0, <10.6.7",">=11.0.0, <11.2.11",">=11.3.0, <11.3.7"],"patched":["10.5.9","10.6.7","11.2.11","11.3.7"],"from":["GHSA-f3cj-mjqm-fhvj","DRUPAL-CORE-2026-001"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-31000","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2025-13081","published":"2025-11-18","fixed":"11.2.8","kev":false},{"cve":"CVE-2025-13082","published":"2025-11-18","fixed":"11.2.8","kev":false},{"cve":"CVE-2025-13083","published":"2025-11-18","fixed":"11.2.8","kev":false},{"cve":"CVE-2026-6365","published":"2026-05-19","fixed":"11.3.7","kev":false},{"cve":"CVE-2026-6366","published":"2026-05-19","fixed":"11.3.7","kev":false},{"cve":"CVE-2026-6367","published":"2026-05-19","fixed":"11.3.7","kev":false},{"cve":"CVE-2026-9082","published":"2026-05-20","fixed":"11.3.10","kev":true,"link":{"from":"CVE-2026-6365","to":"CVE-2026-9082","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"10.5.9","toFixed":"10.5.10","daysApart":1},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"11.2.11","toFixed":"11.2.12","daysApart":1}]}}],"package":"Packagist:drupal/core"}}