ZeroDay Findings
Sign inSign up

Findings

CVE-2026-6365

Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001

Published Apr 15, 2026 · updated Jul 24, 2026 · drupal drupal

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 15, 2026 · Drupal Security

    Detected

    Project: Drupal core Project machine name: drupal <div cl

  2. Jul 24, 2026 · NIST NVD

    Updated

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

Affected

  • cpe drupal/drupalversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-6365

    Official CVE identifier

    cve.org
  • Drupal SecurityVendor advisoryCVE-2026-6365

    Project: Drupal core Project machine name: drupal <div cl

    drupal.org
  • NIST NVDVulnerability recordCVE-2026-6365

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.

    nvd.nist.gov

References