← CVE index
Vulnerability record/PUBLISHED/Published Oct 30, 2026 03:09:48 UTC

CVE-2026-114527

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.

Base score7.1/ 10
SeverityHighCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredNonePR
User interactionRequiredUI
ScopeChangedS
Confidentiality impactLowC
Integrity impactLowI
Availability impactLowA
CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritydrupal
Last updatedNov 6, 2026 15:54:27 UTC
PublishedOct 30, 2026 03:09:48 UTC
ReservedOct 21, 2026 17:08:25 UTC

Credits

  • André Angelantoni (aangel)
  • Octavio Galland (ogalland-tob)
  • Jean Valverde (mogtofu33)
  • Swan Kalata (akalata)
  • Greg Knaddison (greggles)
  • Dave Long (longwave)
  • Drew Webber (mcdruid)
  • Juraj Nemec (poker10)