Navigation module

Reported Context (2)

The fresh Drupal updates also resolve cross-site scripting (XSS) holes in the Drupal core Link module (collectively tracked as CVE-2026-108515) and an XSS flaw in the Navigation module (CVE-2026-108514). Drupal Patches Two Critical Core Flaws With Potential Unauthenticated RCE Paths
The same core releases also fix two moderately critical cross-site scripting flaws, in the Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514), both of which need at least a logged-in user. Drupal Patches Critical Field UI RCE Flaw Requiring Contributed Module Exposure

CVE (4)

People (2)

Vendors (1)

Products (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.