CVE-2026-108099

priority · track · 0DENLUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

no CVSS

Is it mine?

6 products

Who says so?

3 sources

cert_bund · ncsc_nl · osv

No description recorded.

cvss

Technical severity, 0–10. One row per scoring source.

No CVSS score recorded.

The CWE weakness classes this flaw belongs to.

No weakness (CWE) mapping recorded.

Products and version ranges known to be affected.

Vendor and ecosystem advisories describing this.

NCSC-2026-0438Kwetsbaarheden verholpen in Drupal Core en modules door DrupalNL2026-10-19csaf · ncsc_nlNL
Drupal heeft kwetsbaarheden verholpen in de Drupal core Field UI module, Entity List module, Navigation module, Link module en het Gin administratie thema.
WID-SEC-W-2026-3968Drupal Core, Gin Admin Theme und Entity List: Mehrere SchwachstellenDeutsch2026-10-14csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen oder Cross-Site-Scripting-Angriffe durchzuführen.
DRUPAL-CONTRIB-2026-2182026-10-14vendor · osvUS
The Entity List module provides a way to create lists of entities without Views. The module has a remote code execution vulnerability. The vulnerability is not directly exploitable with the module alone, but multiple serious exploit paths exist with other contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.

Which sources assert this record, and when.

published —modified —

External citations — patches, advisories, analysis.

No references recorded.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.