Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Merged summary · from the lead articleSummaries by Vani AI
Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Drupal has rolled out patches for five vulnerabilities, including two critical-severity bugs that could be exploited for remote code execution (RCE). The first resides in the Entity List module, which allows users to create lists of entities without Views, and is tracked as CVE-2026-108099. It is not exploitable with the module alone, but exploit paths exist with other contributed modules. “At…
Coverage
oldest first · one row per article · UTC- · 11d ago
Drupal Security AdvisoriesFirst report
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Drupal core Link module XSS CVE-2026-108515 is moderately critical; 11.4.x should update to 11.4.10.
- · 11d ago
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
Drupal core Navigation module has a permission-gated XSS flaw tracked as CVE-2026-108514.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108097 | — | — | PoC ×2 | — | |
| CVE-2026-108099 | — | — | — | ||
| CVE-2026-108514 | — | — | — | ||
| CVE-2026-108515 | — | — | — |