540 matches found
CVE-2026-96369 Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
CVE-2026-96369
The Drupal Webform module (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 ) is vulnerable to a Web Browser Cache Containing Sensitive Information issue (CWE-525). When JSON:API is enabled, submissions may be cached without correctly varying by the authenticated user. If a webform allows authenticate...
CVE-2026-96369 Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
EUVD-2026-107836
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
CVE-2026-96371 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
CVE-2026-96371
The Drupal Webform module is vulnerable to Stored Cross-site Scripting (XSS) because it does not sufficiently restrict access to raw webform source editing when the Webform UI module is disabled. An attacker with permissions to create or edit webforms can enter source configurations that are rend...
CVE-2026-96371 Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
EUVD-2026-107835
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
CVE-2026-96372 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
CVE-2026-96372
The Drupal Webform module (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 ) is vulnerable to an Insufficient Granularity of Access Control (CWE-1220) issue. The module fails to sufficiently restrict access to configure Remote HTTP Operations handlers, potentially allowing a user with permissions to ...
CVE-2026-96372 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
EUVD-2026-107834
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
EUVD-2026-107833
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
CVE-2026-96366 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
CVE-2026-96366
The Drupal Webform module is vulnerable to an Incorrect Authorization flaw (CWE-863) due to insufficient validation of a managed file upload element during new submission processing. Affected versions include 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 . An attacker with permission to submit a vulnerable ...
CVE-2026-96373 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
CVE-2026-96373
The Drupal Webform module (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 ) is vulnerable to an Incorrect Authorization flaw due to insufficient validation of requested filenames when serving generated submission exports. Under specific configurations, an attacker with permissions to view submission...
CVE-2026-96373 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
CVE-2026-96366 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...