Entity List

Reported Context (4)

The first resides in the Entity List module, which allows users to create lists of entities without Views, and is tracked as CVE-2026-108099. Drupal Patches Two Critical Core Flaws With Potential Unauthenticated RCE Paths
Drupal has patched two critical remote code execution (RCE) vulnerabilities affecting Drupal core and the contributed Entity List module. Drupal Patches Two Critical RCE Vulnerabilities in Core and Entity List
The security issues impact the software core's Field UI module and the contributed Entity List module. Drupal patches two critical remote code execution flaws
Separately, the Entity List module received its own critical remote code execution advisory, CVE-2026-108099, with the same conditions, including a known path that needs no login. Its 3.0.10 release note says the fix Drupal Patches Critical Field UI RCE Flaw Requiring Contributed Module Exposure

CVE (4)

People (2)

Vendors (1)

Products (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.