Vulnerability DRUPAL-CORE-2026-015
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 hours ago
October 14, 2026 at 05:25 PM UTC
No summary available
8.9.0 - 10.6.18 and 11.0.0 - 11.3.18 and 11.4.0 - 12.0.0-beta1
8.9.0 - 10.6.18 and 11.0.0 - 11.3.18 and 11.4.0 - 12.0.0-beta1
Details
The Drupal core Link module provides a field type that can be used for internal and external URLs.
The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 hours ago
No summary available
10.3.0 - 10.6.18 and 11.0.0 - 11.3.18 and 11.4.0 - 12.0.0-beta1 DRUPAL-CORE-2026-016
10.3.0 - 10.6.18 and 11.0.0 - 11.3.18 and 11.4.0 - 12.0.0-beta1 DRUPAL-CORE-2026-016
Unknown
4 hours ago
No summary available
8.9.0 - 10.6.18 and 11.0.0 - 11.3.18 and 11.4.0 - 12.0.0-beta1 DRUPAL-CORE-2026-014
8.9.0 - 10.6.18 and 11.0.0 - 11.3.18 and 11.4.0 - 12.0.0-beta1 DRUPAL-CORE-2026-014
Unknown
28 days ago
No summary available
10.5.0 - 10.6.16 and 11.0.0 - 11.3.16 and 11.4.0 - 11.4.6 DRUPAL-CORE-2026-013
10.5.0 - 10.6.16 and 11.0.0 - 11.3.16 and 11.4.0 - 11.4.6 DRUPAL-CORE-2026-013
Unknown
3 months ago
No summary available
8.0.0-beta10 - 10.6.12 and 11.0.0 - 11.3.13 and 11.4.0 - 11.4.3 DRUPAL-CORE-2026-012
8.0.0-beta10 - 10.6.12 and 11.0.0 - 11.3.13 and 11.4.0 - 11.4.3 DRUPAL-CORE-2026-012
Unknown
3 months ago
No summary available
11.2.0 - 11.3.13 and 11.4.0 - 11.4.3 DRUPAL-CORE-2026-011
11.2.0 - 11.3.13 and 11.4.0 - 11.4.3 DRUPAL-CORE-2026-011
Impacted packages
Timeline
Published
2 hours ago
October 14, 2026 at 05:25 PM UTC
Last Modified
2 hours ago
October 14, 2026 at 06:00 PM UTC