-
Not rated 14 Oct 2026
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mit...
Fixed in 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2 · CVE-2026-108514
-
Not rated 14 Oct 2026
The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in...
Fixed in 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2 · CVE-2026-108515
-
Not rated 14 Oct 2026
A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but mult...
Fixed in 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2 · CVE-2026-108097
-
Not rated 16 Sep 2026
The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing. CKEditor has released [a security update that impacts...
Fixed in 10.6.17, 11.3.17, 11.4.7 · DRUPAL-CORE-2026-013
Check your project in one command
Composer compares your composer.lock with the public advisory databases:
composer auditIt lists every installed package with a known advisory, including drupal/core, and the version that fixes it.