{"action":"Upgrade drupal/core to 10.6.19 or later.","affected":[{"fixed":"10.6.19","introduced":"10.3.0"},{"fixed":"11.3.19","introduced":"11.0.0"},{"fixed":"11.4.10","introduced":"11.4.0"},{"fixed":"12.0.0-beta2","introduced":"12.0.0-alpha1"}],"component":"drupal/core","cve_ids":["CVE-2026-108514"],"ecosystem":"Packagist","exploited":false,"fixed_versions":["10.6.19","11.3.19","11.4.10","12.0.0-beta2"],"id":"tcs_01M5JHJATHF9AJ9G2F9GANP70P","modified_at":"2026-10-17T17:00:03.186936047Z","published_at":"2026-10-14T17:25:38Z","references":["https://osv.dev/vulnerability/DRUPAL-CORE-2026-016","https://www.drupal.org/sa-core-2026-016"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DRUPAL-CORE-2026-016","url":"https://osv.dev/vulnerability/DRUPAL-CORE-2026-016"}],"summary":"The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability."}