CVE-2026-108515Vulnerability
Reported by 3 independent sources · first reported by CERT-FR · last reported
Last reported 5 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw“The fresh Drupal updates also resolve cross-site scripting (XSS) holes in the Drupal core Link module (collectively tracked as CVE-2026-108515) and an XSS flaw in the Navigation module (CVE-2026-108514).”
-
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules“The same core releases also fix two moderately critical cross-site scripting flaws, in the Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514), both of which need at least a logged-in user.”
-
Multiples vulnérabilités dans Drupal (15 octobre 2026)“Référence CVE CVE-2026-108515”
Indicators reported together
named in the same reports- hxxps://drupal[.]org/sa-core-2026-014in 1 report
- hxxps://drupal[.]org/sa-core-2026-015in 1 report
- hxxps://drupal[.]org/sa-core-2026-016in 1 report
Copy these 3 indicators · defanged
Also named with it: CVE-2026-108097, CVE-2026-108514, CVE-2026-108099
Thanks — we review every report.