15 Apr 2026
Drupal.org aggregator
Security advisories: Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5.
The suggestions aren't sufficiently sanitized and a malicious user could trigger a stored cross site scripting attack against another user.
Install the latest version:
- If you use Drupal 11.3.x, update to Drupal 11.3.7
- Drupal versions below 11.3 are not affected by this vulnerability
- Lee Rowlands (larowlan) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Mingsong (mingsong), provisional member of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
15 Apr 2026 7:27pm GMT
Security advisories: Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability.
This issue is not directly exploitable.
This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.
Install the latest version:
- If you use Drupal 10.5.x, update to Drupal 10.5.9.
- If you use Drupal 10.6.x, update to Drupal 10.6.7.
- If you use Drupal 11.2.x, update to Drupal 11.2.11.
- If you use Drupal 11.3.x, update to Drupal 11.3.7.
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)
- Benji Fisher (benjifisher) of the Drupal Security Team
- cilefen (cilefen) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Ra Mänd (ram4nd), provisional member of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
15 Apr 2026 7:25pm GMT
Security advisories: Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which which can lead to a cross-site scripting (XSS) vulnerability.
Install the latest version:
- If you use Drupal 10.5.x, update to Drupal 10.5.9.
- If you use Drupal 10.6.x, update to Drupal 10.6.7.
- If you use Drupal 11.2.x, update to Drupal 11.2.11.
- If you use Drupal 11.3.x, update to Drupal 11.3.7.
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)
- Anna Kalata (akalata) of the Drupal Security Team
- Benji Fisher (benjifisher) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Michael Hess (mlhess) of the Drupal Security Team
- James Gilliland (neclimdul) of the Drupal Security Team
- Joseph Zhao (pandaski) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Ra Mänd (ram4nd), provisional member of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
15 Apr 2026 7:24pm GMT
14 Apr 2026
W3C - Blog
2026 Breakouts Day recap
Breakouts Day 2026 was the third edition of W3C's fully remote community driven information sharing event. In this post we summarize key aspects of the event.
14 Apr 2026 11:03am GMT
03 Apr 2026
W3C - Blog
The W3C TAG Meeting in London, March 2026
Earlier this month, the W3C Technical Architecture Group (TAG) gathered in London for a multi-day face-to-face meeting. While the TAG meets regularly online, these in-person sessions remain an important part of how the group builds shared understanding, tackles complex architectural questions, and welcomes new members into the work.
03 Apr 2026 12:00am GMT
31 Mar 2026
W3C - Blog
Advisory Board publishes Position Statement on AI in Standards Work
Read more about the AB's current thinking on using Large Language Models (LLMs) in the standards process.
31 Mar 2026 8:18pm GMT
18 Jan 2026
Official jQuery Blog
jQuery 4.0.0
On January 14, 2006, John Resig introduced a JavaScript library called jQuery at BarCamp in New York City. Now, 20 years later, the jQuery team is happy to announce the final release of jQuery 4.0.0. After a long development cycle and several pre-releases, jQuery 4.0.0 brings many improvements and modernizations. It is the first major … Continue reading
18 Jan 2026 12:29am GMT
11 Aug 2025
Official jQuery Blog
jQuery 4.0.0 Release Candidate 1
It's here! Almost. jQuery 4.0.0-rc.1 is now available. It's our way of saying, "we think this is ready; now poke it with many sticks". If nothing is found that requires a second release candidate, jQuery 4.0.0 final will follow. Please try out this release and let us know if you encounter any issues. A 4.0 … Continue reading
11 Aug 2025 5:35pm GMT
17 Jul 2024
Official jQuery Blog
Second Beta of jQuery 4.0.0
Last February, we released the first beta of jQuery 4.0.0. We're now ready to release a second, and we expect a release candidate to come soon™. This release comes with a major rewrite to jQuery's testing infrastructure, which removed all deprecated or under-supported dependencies. But the main change that warranted a second beta was a … Continue reading
17 Jul 2024 2:03pm GMT
29 May 2023
Smiley Cat: Christian Watson's Web Design Blog
7 Types of Article Headlines: Craft the Perfect Title Every Time
When it comes to crafting an article, the headline is crucial for grabbing the reader's attention and enticing them to read further. In this post, I'll explore the 7 types of article headlines and provide examples for each using the subjects of product management, user experience design, and search engine optimization. 1. The Know-it-All The […]
The post 7 Types of Article Headlines: Craft the Perfect Title Every Time first appeared on Smiley Cat.
29 May 2023 10:20pm GMT
09 Apr 2023
Smiley Cat: Christian Watson's Web Design Blog
5 Product Management Myths You Need to Stop Believing
Product management is one of the most exciting and rewarding careers in the tech world. But it's also one of the most misunderstood and misrepresented. There are many myths and misconceptions that cloud the reality of what product managers do, how they do it, and what skills they need to succeed. In this blog post, […]
The post 5 Product Management Myths You Need to Stop Believing first appeared on Smiley Cat.
09 Apr 2023 5:28pm GMT
11 Dec 2022
Smiley Cat: Christian Watson's Web Design Blog
The Key Strengths of the Best Product Managers
The role of a product manager is crucial to the success of any product. They are responsible for managing the entire product life cycle, from conceptualization to launch and beyond. A product manager must possess a unique blend of skills and qualities to be effective in their role. Strong strategic thinking A product manager must […]
The post The Key Strengths of the Best Product Managers first appeared on Smiley Cat.
11 Dec 2022 4:43pm GMT