Search
Find a vulnerability
Search criteria
Related vulnerabilities
CERTFR-2026-AVI-1321
Vulnerability from certfr_avis - Published: 2026-10-15 - Updated: 2026-10-15
De multiples vulnérabilités ont été découvertes dans Drupal. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Drupal versions 11.3.x ant\u00e9rieures \u00e0 11.3.19",
"product": {
"name": "Drupal",
"vendor": {
"name": "Drupal",
"scada": false
}
}
},
{
"description": "Drupal versions 10.6.x ant\u00e9rieures \u00e0 10.6.19",
"product": {
"name": "Drupal",
"vendor": {
"name": "Drupal",
"scada": false
}
}
},
{
"description": "Drupal versions 11.4.x ant\u00e9rieures \u00e0 11.4.10",
"product": {
"name": "Drupal",
"vendor": {
"name": "Drupal",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-108097",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108097"
},
{
"name": "CVE-2026-108515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108515"
},
{
"name": "CVE-2026-108514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108514"
}
],
"initial_release_date": "2026-10-15T00:00:00",
"last_revision_date": "2026-10-15T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1321",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Drupal. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Drupal",
"vendor_advisories": [
{
"published_at": "2026-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Drupal SA-CORE-2026-014",
"url": "https://drupal.org/sa-core-2026-014"
},
{
"published_at": "2026-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Drupal SA-CORE-2026-015",
"url": "https://drupal.org/sa-core-2026-015"
},
{
"published_at": "2026-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Drupal SA-CORE-2026-016",
"url": "https://drupal.org/sa-core-2026-016"
}
]
}
NCSC-2026-0438
Vulnerability from csaf_ncscnl - Published: 2026-10-19 08:08 - Updated: 2026-10-19 08:08Summary
Kwetsbaarheden verholpen in Drupal Core en modules door Drupal
Scope
5 vulnerabilities in this advisory, including CVE-2026-108514.
CVE-2026-108514
The Navigation module contains a cross-site scripting (XSS) vulnerability due to insufficient sanitization of certain attributes, exploitable only by users with specific permissions such as 'administer menu' or the ability to enter HTML tags with certain data attributes.
Known affected: 3 products
WID-SEC-W-2026-3968
Vulnerability from csaf_certbund - Published: 2026-10-14 22:00 - Updated: 2026-10-19 22:00Summary
Drupal Core, Gin Admin Theme und Entity List: Mehrere Schwachstellen
Severity
Hoch
Scope
5 vulnerabilities in this advisory, including CVE-2026-108514.
CVE-2026-108514
Known affected: 4 products