CVE-2026-96366 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96373 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96366

The Drupal Webform module is vulnerable to an Incorrect Authorization flaw (CWE-863) due to insufficient validation of a managed file upload element during new submission processing. Affected versions include 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 . An attacker with permission to submit a vulnerable ...

CVE-2026-96373 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96373

The Drupal Webform module (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 ) is vulnerable to an Incorrect Authorization flaw due to insufficient validation of requested filenames when serving generated submission exports. Under specific configurations, an attacker with permissions to view submission...

CVE-2026-96398 Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96398

The Drupal Webform module is vulnerable to an incorrect authorization issue that allows forceful browsing . The module fails to sufficiently restrict access to certain submission view modes, potentially allowing a user who can view a submission to access a more permissive view mode and view restr...

CVE-2026-96398 Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96398 Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96356 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96356

The Drupal Webform module contains an Incorrect Authorization vulnerability (CWE-863) that enables Forceful Browsing . The root cause is a failure to sufficiently guard user-specific access rules against malformed saved configurations . Under specific site conditions, these rules may inadvertentl...

CVE-2026-96356 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96391

The Drupal Webform REST module (versions 0.0.0 to 4.2.1 ) is vulnerable to an access bypass due to missing authorization checks. The root cause is the module's failure to sufficiently verify permissions when retrieving webform elements or fields , as well as webform submission entities . This fla...

CVE-2026-96391 Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1...

CVE-2026-96391 Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1...

CVE-2026-96377 Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7...

CVE-2026-96377

The Combined image style Drupal module (versions 0.0.0 to 1.0.7 ) contains an Allocation of Resources Without Limits or Throttling vulnerability (CWE-770). The root cause is insufficient validation of image style names during the generation of image derivatives, which allows anonymous users to ge...

CVE-2026-96377 Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7...

CVE-2026-96377 Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7...

CVE-2026-96380

The Drupal CSS Usage Analyzer module (versions 1.0.0 through 1.0.2 ) contains a Missing Authorization vulnerability. The root cause is that the module fails to sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions. This allows for Forceful Browsing , wh...