14 Oct 2026

feedDrupal.org aggregator

Dynamosys Insights: Drupal 11.4.10 Fixes Critical Security Flaw: What Site Owners Should Do Now

A blue Drupal emblem stands behind a shield with a padlock beside the words “Drupal 11.4.10 Security Update.

Drupal 11.4.10 addresses three core security vulnerabilities, including a critical remote code execution flaw. Site owners should prioritize the appropriate core update and check whether separate Gin or Entity List updates also apply.

14 Oct 2026 7:20pm GMT

Darren Oh: Try the Drupal AI demo!

Try the Drupal AI demo!

The Drupal AI demo was unveiled at DrupalCon Rotterdam. It showcases how you can use AI in your Drupal site right now.

Darren Oh

Tags

14 Oct 2026 6:59pm GMT

Security advisories: Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

Project:
Drupal core
Project machine name:
drupal
Date:
2026-October-14
Security risk:
Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability:
Cross-site scripting
Affected versions:
>= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2
CVE IDs:
CVE-2026-108514
Description:

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.

Solution:

Install the latest version:

Drupal 11

  • If you use Drupal 11.4.x, update to Drupal 11.4.10.
  • If you use Drupal 11.3.x, update to Drupal 11.3.19.
  • Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

  • If you use Drupal 10.6.x, update to Drupal 10.6.19.
  • Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Drupal 8 and Drupal 9 have both reached end-of-life.

Reported By:
Fixed By:
Coordinated By:

14 Oct 2026 5:25pm GMT