CVE-2026-6367

Drupal core vulnerable component: CKEditor 5 entity suggestions. Versions 11.3.0–11.3.6 expose an XSS due to insufficient sanitization of the suggestions; fixed in 11.3.7. Applies to Drupal core 11.3.x (11.3.0–11.3.6). Remediation: update to 11.3.7 per PT-2026-33242 / SA-CORE-2026-003. Exploitati...

CVE-2026-6367 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core: from 11.3.0 before 11.3.7...