CVE-2026-108099
NoneCVSS
—
EPSS
—
Published
Oct 30, 2026
CISA due date
—
The record
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119578 MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg… CWE-470
- CVE-2026-108097 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CWE-470
- CVE-2026-119050 Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that… CWE-470
- CVE-2026-116692 MLflow is an open source AI engineering platform for agents, large language models, and… CWE-470
- CVE-2026-115931 Postiz lets a signed-in user ask the backend to run a function on one of their connected… CWE-470
- CVE-2026-115886 MLflow is an open source AI engineering platform for agents, large language models, and… CWE-470
- CVE-2026-115749 hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an… CWE-470
- CVE-2026-114660 Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in… CWE-470