CVE-2026-96359 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Webform allows Cross-Site Scripting XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

EUVD-2026-107841

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Webform allows Cross-Site Scripting XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96362 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Webform allows Cross-Site Scripting XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96362

The Drupal Webform module is vulnerable to Cross-Site Scripting (XSS) due to insufficient filtering of response values from Remote Post handlers . When these handlers send data to external APIs, the module fails to properly sanitize the returned values before they are rendered via handler respons...

CVE-2026-96362 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Webform allows Cross-Site Scripting XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96363 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

EUVD-2026-107840

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96363

The Drupal Webform module, specifically the Webform Entity Print submodule, is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient access limitations on its print templates. Affected versions include Webform 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 . To exploit this, an attacker must po...

EUVD-2026-107839

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

EUVD-2026-107838

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96368 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96368 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96368

The Drupal Webform module is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization of certain tooltips and help text provided by site builders. This vulnerability affects Webform versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 . The risk is mitigated by the requirement that...

CVE-2026-96367

The Drupal Webform module is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient access restrictions on the custom attributes YAML editor . Specifically, users granted permission to create or edit webforms—but who lack permissions to edit the webform source—can add custom attribut...

CVE-2026-96367 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96367 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96370

The Drupal Webform module is vulnerable to Server-Side Request Forgery (SSRF) due to an incorrect authorization issue in the Webform Submission Export/Import submodule. The submodule fails to sufficiently validate access to its export and import functionality. An attacker with permissions to edit...

CVE-2026-96370 Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

EUVD-2026-107837

Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96370 Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...