What’s Vulnerable › Products

Drupal Webform vulnerabilities

20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.

Check whether your Drupal Webform version is affected

Latest Drupal Webform vulnerabilities

• CVE-2026-96398 — Webform - Less critical - Access bypass - SA-CONTRIB-2026-173 (CVSS 4.3)
• CVE-2026-96373 — Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168 (CVSS 3.3)
• CVE-2026-96372 — Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167 (CVSS 5.4)
• CVE-2026-96371 — Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166 (CVSS 5.4)
• CVE-2026-96370 — Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164 (CVSS 5.4)
• CVE-2026-96369 — Webform - Less critical - Access bypass - SA-CONTRIB-2026-165 (CVSS 3.1)
• CVE-2026-96368 — Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163 (CVSS 4.6)
• CVE-2026-96367 — Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162 (CVSS 4.6)
• CVE-2026-96366 — Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169 (CVSS 5.3)
• CVE-2026-96365 — Webform - Less critical - Denial of service - SA-CONTRIB-2026-170 (CVSS 7.5)
• CVE-2026-96364 — Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171 (CVSS 5.3)
• CVE-2026-96363 — Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161
• CVE-2026-96362 — Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160 (CVSS 4.2)
• CVE-2026-96361 — Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155 (CVSS 4.6)
• CVE-2026-96360 — Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154 (CVSS 3.5)
• CVE-2026-96359 — Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159 (CVSS 4.6)
• CVE-2026-96358 — Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158 (CVSS 4.6)
• CVE-2026-96357 — Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172 (CVSS 4.6)
• CVE-2026-96356 — Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174 (CVSS 5.3)
• CVE-2026-96355 — Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175 (CVSS 9.1)