CVE-2026-18986

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Drupal Entity Browser contrib module (versions 0.0.0 through 2.16.0 ). The root cause is insufficient sanitization of tab titles , allowing an attacker with sufficient privileges to inject malicious HTML with specific attributes on a...