Drupal
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
SA-CORE-2026-001 Apr 15, 2026 Source: Vendor
Imported by the Drupal advisory catcher from https://www.drupal.org/sa-core-2026-001. 1 reporter(s), 10 fixer(s). Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.drupal.org/sa-core-2026-001
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
11 lines
Showing 1–11 of 11
CVE-2026-6365
BR2026-0000-008578
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Murat Kekiç (murat_kekic)
CVE-2026-6365
BR2026-0000-008579
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Anna Kalata (akalata) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008580
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Benji Fisher (benjifisher) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008581
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Neil Drumm (drumm) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008582
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Lee Rowlands (larowlan) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008583
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Michael Hess (mlhess) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008584
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as James Gilliland (neclimdul) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008585
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Joseph Zhao (pandaski) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008586
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Juraj Nemec (poker10) of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008587
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Ra Mänd (ram4nd), provisional member of the Drupal Security Team
CVE-2026-6365
BR2026-0000-008588
unclaimed
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Credited as Jess (xjm) of the Drupal Security Team