Advisories · Technology

Drupal Webform.

Every CVE that names Drupal Webform among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-96360 CVE record

CVSS 3.5 Low

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154
- Drupal Webform
- Cross-site scripting (XSS)
Not analysed yet 22 Oct 2026
CVE-2026-96361 CVE record

CVSS 4.6 Medium

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155
- Drupal Webform
- Cross-site scripting (XSS)
Not analysed yet 22 Oct 2026
CVE-2026-96358 CVE record

CVSS 4.6 Medium

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158
- Drupal Webform
- Cross-site scripting (XSS)
Not analysed yet 22 Oct 2026
CVE-2026-96359 CVE record

CVSS 4.6 Medium

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159
- Drupal Webform
- Cross-site scripting (XSS)
Not analysed yet 22 Oct 2026
CVE-2026-96362 CVE record

CVSS 4.2 Medium

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160
- Drupal Webform
- Cross-site scripting (XSS)
Not analysed yet 22 Oct 2026
CVE-2026-96363 CVE record

CVSS 3.1 Low

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161
- Drupal Webform
- Privilege escalation
Not analysed yet 22 Oct 2026
CVE-2026-96367 CVE record

CVSS 4.6 Medium

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162
- Drupal Webform
- Privilege escalation
Not analysed yet 22 Oct 2026
CVE-2026-96368 CVE record

CVSS 4.6 Medium

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163
- Drupal Webform
- Cross-site scripting (XSS)
Not analysed yet 22 Oct 2026
CVE-2026-96370 CVE record

CVSS 5.4 Medium

Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164
- Drupal Webform
- Broken access control
Not analysed yet 22 Oct 2026
CVE-2026-96369 CVE record

CVSS 3.1 Low

Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
- Drupal Webform
- CWE-525
Not analysed yet 22 Oct 2026
CVE-2026-96371 CVE record

CVSS 5.4 Medium

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166
- Drupal Webform
- Privilege escalation
Not analysed yet 22 Oct 2026
CVE-2026-96372 CVE record

CVSS 5.4 Medium

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
- Drupal Webform
- CWE-1220
Not analysed yet 22 Oct 2026
CVE-2026-96373 CVE record

CVSS 3.3 Low

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168
- Drupal Webform
- Broken access control
Not analysed yet 22 Oct 2026
CVE-2026-96366 CVE record

CVSS 5.3 Medium

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
- Drupal Webform
- Broken access control
Not analysed yet 22 Oct 2026
CVE-2026-96365 CVE record

CVSS 7.5 High

Webform - Less critical - Denial of service - SA-CONTRIB-2026-170
- Drupal Webform
- Denial of service
Not analysed yet 22 Oct 2026
CVE-2026-96364 CVE record

CVSS 5.3 Medium

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171
- Drupal Webform
- CWE-799
Not analysed yet 22 Oct 2026
CVE-2026-96357 CVE record

CVSS 4.6 Medium

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172
- Drupal Webform
- Cross-site scripting (XSS)
Not analysed yet 22 Oct 2026
CVE-2026-96398 CVE record

CVSS 4.3 Medium

Webform - Less critical - Access bypass - SA-CONTRIB-2026-173
- Drupal Webform
- Broken access control
Not analysed yet 22 Oct 2026
CVE-2026-96356 CVE record

CVSS 5.3 Medium

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174
- Drupal Webform
- Broken access control
Not analysed yet 22 Oct 2026
CVE-2026-96355 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
- Drupal Webform
- Code injection
Not analysed yet 22 Oct 2026