Drupal
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
SA-CORE-2026-003 Apr 15, 2026 Source: Vendor
Imported by the Drupal advisory catcher from https://www.drupal.org/sa-core-2026-003. 4 reporter(s), 3 fixer(s). Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.drupal.org/sa-core-2026-003
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
7 lines
Showing 1–7 of 7
CVE-2026-6367
BR2026-0000-008559
unclaimed
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Credited as cantina_security
CVE-2026-6367
BR2026-0000-008560
unclaimed
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Credited as Dries Buytaert (dries)
CVE-2026-6367
BR2026-0000-008561
unclaimed
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Credited as Dmitrijs Trizna (dtrizna)
CVE-2026-6367
BR2026-0000-008562
unclaimed
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Credited as Shirsendu Mondal
CVE-2026-6367
BR2026-0000-008563
unclaimed
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Credited as Lee Rowlands (larowlan) of the Drupal Security Team
CVE-2026-6367
BR2026-0000-008564
unclaimed
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Credited as Drew Webber (mcdruid) of the Drupal Security Team
CVE-2026-6367
BR2026-0000-008565
unclaimed
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Credited as Mingsong (mingsong), provisional member of the Drupal Security Team