Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 32

Export CSV
CVE-2026-96363

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96391

Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96355

Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-84921

Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform Submissions Delete
CVE-2026-96372

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167

Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96371

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96362

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96369

Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96370

Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96368

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96367

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96359

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96358

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96361

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96360

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96398

Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96357

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96365

Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96356

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform
CVE-2026-96373

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Webform