Entity List module

Drupal has released security updates fixing two critical remote code execution vulnerabilities: CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module. All currently supported versions of Drupal core are affected, and the project's security team warns that working exploits could emerge within hours or days, urging site administrators to apply the patches immediately.