Drupal Security Team

Mentions · 7d2
Mentions · 30d3
All mentions3
First seenOct 15, 2026
Last mentioned6d ago

Timeline

3 articles · newest first

Drupal Field UI flaw can allow unauthenticated takeover (CVE-2026-108097)

Core alone is not directly exploitable, but contributed modules or custom code can open unauthenticated paths; no public exploit is reported.

Cyber Security NewsOct 19, 18:13 UTC · 6d agoVulnerability 4 sourcesCVE-2026-1080971 · 1 read

Drupal warns of critical Field UI RCE in core (CVE-2026-108097)

Core alone is not directly exploitable, but at least one contributed-module path needs no login.

GBHackersupdated Oct 19, 18:13 UTC · 6d agofirst Oct 19, 12:39 UTC · 6d agoVulnerability 4 sourcesCVE-2026-1080971 · 1 read

Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules

Drupal patched critical Field UI RCE CVE-2026-108097, reachable without login through some contributed modules, with no attacks reported.

The Hacker NewsOct 15, 12:07 UTC · 10d agoVulnerabilityCVE-2026-108097 CVE-2026-108099 CVE-2026-108514+13 · 2 reads

Related CVEs

by mentions

CVE-2026-108097—
published —PoC ×2
CVE-2026-108514—
published —
CVE-2026-108515—
published —
CVE-2026-108099—
published —

Appears with

Field UIproduct · 3
Drupalvendor · 3
Acquiaorganization · 1
Drupalproduct · 1
Pantheonorganization · 1
Entity Listproduct · 1
Drupalorganization · 1

Entities are extracted by the model from each article. First seen Oct 15, 2026, last mentioned 6d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.