DRUPAL-CONTRIB-2026-169

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments. In affected configuration...

DRUPAL-CONTRIB-2026-167

The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers. This vulnerability could allow a user with permission to edit a webform to configure a remote HTTP operation. The update...

DRUPAL-CONTRIB-2026-164

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not...

DRUPAL-CONTRIB-2026-160

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Remote Post Handlers send webform data to other servers via APIs. The module does not sufficiently...

DRUPAL-CONTRIB-2026-159

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficiently sanitize attributes used by its color element. Under certain conditions, specially crafted attributes could result in cross-site scripti...

DRUPAL-CONTRIB-2026-158

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a rating element, which did not sufficiently validate its data. Under specific circumstances, this could allow cross-site scripting on a page with a...

PT-2026-97660

Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description Insufficient sanitization of tooltips and help text within the Webform module allows for cross-site scripting XSS, a technique where malicious scripts are injected into trusted websites...

PT-2026-97678

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...

PT-2026-97661

Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description When the Webform module is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. This occurs when a webform is configured to...

PT-2026-97659

Name of the Vulnerable Software and Affected Versions Drupal Webform versions 6.2.x through 6.3.x Description The Webform module does not sufficiently restrict access to the custom attributes YAML editor. Users with permissions to create or edit webforms, but lacking permissions to edit the webfo...

PT-2026-97647

Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description The Webform module fails to sufficiently exclude certain format templates from token replacement. This allows an attacker to submit data that is evaluated as template code during the rendering...

PT-2026-97652

Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description An issue exists in the Webform module, which is used to create forms and collect submissions. Due to improper sanitization of announcement text used for assistive technologies, specially craft...

PT-2026-97649

Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description The Webform module fails to properly force the download of certain uploaded file types when they are served. In specific site configurations, a file uploaded via a webform can b...

PT-2026-97657

Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description The Webform module fails to sufficiently validate an optional token query value. In specific configurations where a form is rendered for anonymous visitors, a malicious request...

PT-2026-97668

The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary...

PT-2026-97654

Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description The Webform module, used for creating forms and processing submissions, contains a flaw in how it handles Remote Post handlers. These handlers send data to external servers via APIs. The modul...

Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

This module enables you to add an extra authentication layer to the API. The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability...

Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. Th...

PT-2026-97656

Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description The Webform Share submodule, which allows site builders to expose webforms for embedding on other sites, contains a flaw where submissions for Ajax-enabled webforms can bypass...