CVE-2026-87954

The Drupal Taxonomy Term Glossary module (versions 0.0.0 to 4.6.0 ) contains a Missing Authorization vulnerability (CWE-862) that allows Forceful Browsing . The root cause is that the module fails to sufficiently check access permissions for taxonomy terms. Consequently, anonymous users can acces...

CVE-2026-87954 Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152

Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0...

CVE-2026-87955 Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153

Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1...

CVE-2026-87955 Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153

Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1...

CVE-2026-87955

The Drupal Ultimate Table Field module (versions 0.0.0 to 1.1.1 and 2.0.0 to 2.0.1 ) contains a Missing Authorization vulnerability. The module fails to sufficiently protect the route used to open the cell editor dialog, which is accessible to anonymous users . An attacker can leverage this to pe...

CVE-2026-87955 Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153

Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1...

CVE-2026-96369 Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96369 Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96369

The Drupal Webform module (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 ) is vulnerable to a Web Browser Cache Containing Sensitive Information issue (CWE-525). When JSON:API is enabled, submissions may be cached without correctly varying by the authenticated user. If a webform allows authenticate...

EUVD-2026-107836

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

EUVD-2026-107834

Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96372 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167

Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96372 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167

Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96372

The Drupal Webform module (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 ) is vulnerable to an Insufficient Granularity of Access Control (CWE-1220) issue. The module fails to sufficiently restrict access to configure Remote HTTP Operations handlers, potentially allowing a user with permissions to ...

CVE-2026-96366 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96373 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96366 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96373 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96373

The Drupal Webform module (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 ) is vulnerable to an Incorrect Authorization flaw due to insufficient validation of requested filenames when serving generated submission exports. Under specific configurations, an attacker with permissions to view submission...

CVE-2026-96366

The Drupal Webform module is vulnerable to an Incorrect Authorization flaw (CWE-863) due to insufficient validation of a managed file upload element during new submission processing. Affected versions include 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 . An attacker with permission to submit a vulnerable ...