19153 matches found
PT-2026-97658
Name of the Vulnerable Software and Affected Versions Drupal Webform affected versions not specified Description Insufficient validation of a managed file upload element during the processing of new submissions allows a user with submission access to potentially access other managed files they ar...
PT-2026-97650
Name of the Vulnerable Software and Affected Versions Drupal Contributed Module affected versions not specified Description The Webform module contains a rating element that does not sufficiently validate data. This flaw could allow cross-site scripting XSS, a technique where malicious scripts ar...
CVE-2026-96358
The Webform module for Drupal contains a vulnerability in its rating element due to insufficient data validation. This flaw could allow cross-site scripting (XSS) on pages featuring a rating element. The risk is mitigated by the requirement that an attacker must first be able to place crafted HTM...
CVE-2026-96385
The REST & JSON API Authentication for Drupal module is vulnerable to an access bypass because it does not sufficiently validate authentication requirements for all API requests. This flaw allows for the circumvention of the extra authentication layer intended for the API. No specific patch versi...
PT-2026-97662
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not...
CVE-2026-96386
The Smart Content Block submodule of the Smart Content module for Drupal contains an access bypass vulnerability. The root cause is an insufficient check of block access when the module renders blocks of a "Display Blocks" reaction via its AJAX endpoint . Impact is mitigated if sites only use Vie...
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a rating element, which did not sufficiently validate its data. Under specific circumstances, this could allow cross-site scripting on a page with a...
PT-2026-97669
This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token,...
PT-2026-97680
This module enables you to retrieve and submit webforms via REST. The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields...
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. Under certain configurations, th...
CVE-2026-96362
The Webform module for Drupal contains a cross-site scripting (XSS) vulnerability. The root cause is the insufficient filtering of response values from the Remote Post handler before they are rendered via handler response tokens . If a site uses these tokens in rendered output and an attacker can...
Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform did not sufficiently guard user-specific access rules against a malformed saved configuration. Under certain site-specific conditions, an access rule intended t...
Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186
This module enables you to retrieve and submit webforms via REST. The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields...
CVE-2026-96374
The Project Browser module for Drupal is vulnerable to cross-site request forgery (CSRF) attacks because it fails to sufficiently validate administrative actions performed through the web user interface. An attacker could potentially exploit this to apply recipes or enable modules without proper ...
Drupal - Remote Code Execution
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. id: CVE-2018-7600 info: name: Drupal - Remote Code Execution author:...
Drupal SEoL (7.x)
According to its version, Drupal is 7.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable, Inc...
CLSA-2026-1789642476 TuxCare security update for drupal/webform_multifile (1 CVE)
TuxCare rebuilt drupal/webformmultifile to address 1 CVE. Fixed in 7.1.6-p1+tuxcare...
CLSA-2026-1789638824 TuxCare security update for drupal/tfa_basic (1 CVE)
TuxCare rebuilt drupal/tfabasic to address 1 CVE. Fixed in 7.1.2-p1+tuxcare...