NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

CVE-2026-108515

CVSS: —
EPSS: —
Published: —
Modified: —

Analyze CVE-2026-108515 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

NVD CVE.org GitHub PoCs EPSS (—)

In the news

3 stories

Drupal patches two critical RCE flaws and XSS bugs

Fixes are in Drupal 11.4.10, 11.3.19 and 10.6.19, plus Entity List 3.0.10; Field UI can be uninstalled.

SecurityWeekOct 19, 15:47 UTC · 6d agoVulnerabilityCVE-2026-108099 CVE-2026-108097 CVE-2026-108515+11 · 1 read

74

Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules

Drupal patched critical Field UI RCE CVE-2026-108097, reachable without login through some contributed modules, with no attacks reported.

The Hacker NewsOct 15, 12:07 UTC · 10d agoVulnerabilityCVE-2026-108097 CVE-2026-108099 CVE-2026-108514+13 · 2 reads

74

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015

Drupal core Link module XSS CVE-2026-108515 is moderately critical; 11.4.x should update to 11.4.10.

Drupal Security AdvisoriesOct 14, 17:25 UTC · 11d agoVulnerabilityCVE-2026-1085151 · 1 read

44