Drupal released patches for five vulnerabilities, including two critical remote code execution flaws in contributed modules and core components.

Users are urged to update to Entity List 3.0.10 and Drupal versions 11.4.10, 11.3.19, or 10.6.19, as older releases have reached end-of-life and will not receive security updates.

Drupal notes that there was no stated exploitation in the wild yet, but emphasizes timely core updates because exploits could be developed within hours or days.

The second critical flaw resides in the core Field UI module (CVE-2026-108097); exploit paths exist via contributed modules and can allow unauthenticated access, so uninstalling the core Field UI module is advised.

The first critical flaw is in the Entity List module (CVE-2026-108099) with exploit paths via other contributed modules, and at least one path does not require authentication.

Other patched issues include XSS fixes in the core Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514), plus a security defect in the Gin administration theme addressed in Gin 5.0.16 and 4.1.4.