CVE-2026-108099CWE-470

CVE-2026-108099: vulnerability in Drupal Entity List

Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218

Published

Follow this CVE+ Monitor Entity List+ Monitor drupal/entity_list

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.3%
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.
Affected products
Drupal · Entity List