Drupal security note

What changed

• CVE-2026-108514 — Open the advisory

  The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

  Affected: 10.3.0 → 10.6.19, 10.3.0 → 10.6.19; 11.0.0 → 11.3.19; 11.4.0 → 11.4.10

• CVE-2026-108097 — Open the advisory

  A remote code execution vulnerability exists within the Field UI module in Drupal core.

  Affected: 8.9.0 → 10.6.19, 8.9.0 → 10.6.19; 11.0.0 → 11.3.19; 11.4.0 → 11.4.10

• CVE-2026-108515 — Open the advisory

  The Drupal core Link module provides a field type that can be used for internal and external URLs.

  Affected: 8.9.0 → 10.6.19, 8.9.0 → 10.6.19; 11.0.0 → 11.3.19; 11.4.0 → 11.4.10

• CVE-2026-108099 — Open the advisory

  The Entity List module provides a way to create lists of entities without Views.

  Affected: 0 → 3.0.10

• CVE-2026-110738 — Open the advisory

  Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators.

  Affected: 0 → 4.1.4, 0 → 4.1.4; 5.0.0 → 5.0.16

What we still do not know

Every changed record in this note has a version range.