#drupal

Drupal patches critical remote code execution flaws in core and Entity List, warns exploits may follow fast

CVE-2026-108097 in Field UI needs a contributed module to be reachable, but one known path needs no login, and end-of-life versions get no fix.