EUVD-2026-107838

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96368

The Drupal Webform module is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization of certain tooltips and help text provided by site builders. This vulnerability affects Webform versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 . The risk is mitigated by the requirement that...

CVE-2026-96367 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96368 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96370 Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

EUVD-2026-107837

Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96370

The Drupal Webform module is vulnerable to Server-Side Request Forgery (SSRF) due to an incorrect authorization issue in the Webform Submission Export/Import submodule. The submodule fails to sufficiently validate access to its export and import functionality. An attacker with permissions to edit...

CVE-2026-96370 Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96370 Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

EUVD-2026-107836

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96369 Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96369

The Drupal Webform module (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 ) is vulnerable to a Web Browser Cache Containing Sensitive Information issue (CWE-525). When JSON:API is enabled, submissions may be cached without correctly varying by the authenticated user. If a webform allows authenticate...

CVE-2026-96369 Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96371 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

EUVD-2026-107835

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96371 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96371

The Drupal Webform module is vulnerable to Stored Cross-site Scripting (XSS) because it does not sufficiently restrict access to raw webform source editing when the Webform UI module is disabled. An attacker with permissions to create or edit webforms can enter source configurations that are rend...

CVE-2026-96372 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167

Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

EUVD-2026-107834

Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96372

The Drupal Webform module (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 ) is vulnerable to an Insufficient Granularity of Access Control (CWE-1220) issue. The module fails to sufficiently restrict access to configure Remote HTTP Operations handlers, potentially allowing a user with permissions to ...