Vulnerability DRUPAL-CORE-2026-016
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 hours ago
October 14, 2026 at 05:25 PM UTC
No summary available
10.3.0 - 10.6.18 and 11.0.0 - 11.3.18 and 11.4.0 - 12.0.0-beta1
10.3.0 - 10.6.18 and 11.0.0 - 11.3.18 and 11.4.0 - 12.0.0-beta1
Details
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 hours ago
No summary available
8.9.0 - 10.6.18 and 11.0.0 - 11.3.18 and 11.4.0 - 12.0.0-beta1 DRUPAL-CORE-2026-015
8.9.0 - 10.6.18 and 11.0.0 - 11.3.18 and 11.4.0 - 12.0.0-beta1 DRUPAL-CORE-2026-015
Unknown
4 hours ago
No summary available
8.9.0 - 10.6.18 and 11.0.0 - 11.3.18 and 11.4.0 - 12.0.0-beta1 DRUPAL-CORE-2026-014
8.9.0 - 10.6.18 and 11.0.0 - 11.3.18 and 11.4.0 - 12.0.0-beta1 DRUPAL-CORE-2026-014
Unknown
28 days ago
No summary available
10.5.0 - 10.6.16 and 11.0.0 - 11.3.16 and 11.4.0 - 11.4.6 DRUPAL-CORE-2026-013
10.5.0 - 10.6.16 and 11.0.0 - 11.3.16 and 11.4.0 - 11.4.6 DRUPAL-CORE-2026-013
Unknown
3 months ago
No summary available
8.0.0-beta10 - 10.6.12 and 11.0.0 - 11.3.13 and 11.4.0 - 11.4.3 DRUPAL-CORE-2026-012
8.0.0-beta10 - 10.6.12 and 11.0.0 - 11.3.13 and 11.4.0 - 11.4.3 DRUPAL-CORE-2026-012
Unknown
3 months ago
No summary available
11.2.0 - 11.3.13 and 11.4.0 - 11.4.3 DRUPAL-CORE-2026-011
11.2.0 - 11.3.13 and 11.4.0 - 11.4.3 DRUPAL-CORE-2026-011
Impacted packages
Timeline
Published
2 hours ago
October 14, 2026 at 05:25 PM UTC
Last Modified
2 hours ago
October 14, 2026 at 06:00 PM UTC