CVE-2026-108097

Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-108097, Summary: Drupal core: - CVE-2026-108097: A remote code execution vulnerability exists within the Field UI module in Drupal core. - CVE-2026-108515: The Drupal core Link module provides a field type that can be used for internal and external URLs. - CVE-2026-108514:The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. Entity List: CVE-2026-108099: The Entity List module provides a way to create lists of entities without Views. The module has a remote code execution vulnerability. Gin Admin Theme: - CVE-2026-110738: The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. See also: https://www.drupal.org/sa-core-2026-015, See also: https://www.drupal.org/sa-contrib-2026-218, See also: https://www.drupal.org/sa-contrib-2026-219, See also: https://www.drupal.org/sa-core-2026-016