CVE-2026-6365

score

<0.1

cvss

6.1

epss

0.3%

published

2026-05-19

kev added

—

first seen

2026-10-21

Drupal Drupal core from 8.0.0 before 10.5.9, 10.6.0 before 10.6.7, 11.0.0 before 11.2.11, and 11.3.0 before 11.3.7 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in users' browsers, exploit requires crafted input.