Drupal published five security repairs this week, two of them rated critical and both able to hand an attacker remote code execution. Neither bug fires on an untouched default install, yet add-on modules open real attack routes, and one of those routes needs no login at all.
Two critical holes
Entity List carries the first, filed as CVE-2026-108099. There, users build entity collections without Views. Drupal’s own advisory adds that bespoke site code can expose the same weakness, so a clean module inventory does not guarantee safety. Field UI in Drupal core holds the second, filed as CVE-2026-108097. Contributed code supplies dangerous paths into it, again including an unauthenticated one, and administrators who can live without the module may simply uninstall it as a stopgap.
Patched builds are Entity List 3.0.10 with Drupal 11.4.10, 11.3.19 or 10.6.19; anything older has reached end-of-life.
The lesser flaws
Three more issues ship in the same batch. Cross-site scripting bugs in the core Link module carry the shared identifier CVE-2026-108515, while the Navigation module has its own XSS entry, CVE-2026-108514. Gin, an administration theme, also needed a fix; versions 5.0.16 and 4.1.4 include it.
Drupal reports no in-the-wild use of any of these. Its guidance from October 12 still stands, though: administrators were told to book time for core updates because working exploits could appear in hours or days. Advisory details live on the project’s security page.
Sequencing the upgrade
Where Field UI is unused, removing it kills the second critical path today. Otherwise the patch belongs in this week’s maintenance window. Check contributed modules against the Entity List advisory before anything else, since unauthenticated exposure is likeliest there, then re-audit the rebuilt site for gaps the update missed.
