{"action":"Upgrade drupal/core to 10.6.19 or later.","affected":[{"fixed":"10.6.19","introduced":"8.9.0"},{"fixed":"11.3.19","introduced":"11.0.0"},{"fixed":"11.4.10","introduced":"11.4.0"},{"fixed":"12.0.0-beta2","introduced":"12.0.0-alpha1"}],"component":"drupal/core","cve_ids":["CVE-2026-108515"],"ecosystem":"Packagist","epss":0.00197,"exploited":false,"fixed_versions":["10.6.19","11.3.19","11.4.10","12.0.0-beta2"],"id":"tcs_01M5KERDKQK0HP479MQM1D818B","modified_at":"2026-10-14T18:11:06.211689Z","published_at":"2026-10-14T17:25:19Z","references":["https://osv.dev/vulnerability/DRUPAL-CORE-2026-015","https://www.drupal.org/sa-core-2026-015"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DRUPAL-CORE-2026-015","url":"https://osv.dev/vulnerability/DRUPAL-CORE-2026-015"}],"summary":"The Drupal core Link module provides a field type that can be used for internal and external URLs."}