Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    DRUPAL-CONTRIB-2026-204 (CVE-2026-107265)

    Vulnerability from drupal – Published: 2026-10-07 16:28 – Updated: 2026-10-07 16:28 – Source website
    VLAI
    Details

    The Leaflet module provides integration with the Leaflet JS mapping library.

    Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability.

    This vulnerability is mitigated by the fact an attacker needs to have permission to create or edit content that is used in a Leaflet map.

    Credits
    Marcus Johansson (marcus_johansson) www.drupal.org/u/marcus_johansson
    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c10.4.13"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/leaflet"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c10.4.13"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.4.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-107265"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/marcus_johansson"
      ],
      "name": "Marcus Johansson (marcus_johansson)"
    }
  ],
  "details": "The Leaflet module provides integration with the Leaflet JS mapping library.\n\nUnder certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability.\n\nThis vulnerability is mitigated by the fact an attacker needs to have permission to create or edit content that is used in a Leaflet map.",
  "id": "DRUPAL-CONTRIB-2026-204",
  "modified": "2026-10-07T16:28:49.000Z",
  "published": "2026-10-07T16:28:49.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-204"
    }
  ],
  "schema_version": "1.7.0"
}