Drupal
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
SA-CORE-2026-001 Apr 15, 2026 Source: Vendor
Imported by the Drupal advisory catcher from https://www.drupal.org/sa-core-2026-001. 1 reporter(s), 10 fixer(s). Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.drupal.org/sa-core-2026-001
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
11 lines
Showing 1–11 of 11
CVE-2026-6365
BR2026-0000-008578
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Murat Kekiç (murat_kekic)
CVE-2026-6365
BR2026-0000-008579
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Anna Kalata (akalata) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008580
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Benji Fisher (benjifisher) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008581
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Neil Drumm (drumm) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008582
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Lee Rowlands (larowlan) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008583
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Michael Hess (mlhess) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008584
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as James Gilliland (neclimdul) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008585
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Joseph Zhao (pandaski) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008586
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Juraj Nemec (poker10) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008587
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Ra Mänd (ram4nd), provisional member of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008588
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Jess (xjm) of the Drupal Security Team