Vulnerabilities

Summary — last 7 days

New vulnerabilities4,742▼ 546 vs. last week

Critical / high1,843▼ 1,222 vs. last week

New active exploitation (KEV)8▲ 1 vs. last week

Unscored (no CVSS)811▲ 696 vs. last week

More filters

22 results, sorted by published date (most recent first)

CVE	Status	Severity	EPSS	Active exploitation	Affected technologies	Published ▼	Modified	Description
CVE-2026-96398	Received	Unscored	—	—	Webform^AI	10/22/2026	10/22/2026	Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96391	Received	Unscored	—	—	Drupal Webform Rest^AI	10/22/2026	10/22/2026	Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
CVE-2026-96373	Received	Unscored	—	—	Drupal Webform^AI	10/22/2026	10/22/2026	Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96372	Received	Unscored	—	—	Drupal Webform^AI	10/22/2026	10/22/2026	Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96371	Received	Unscored	—	—	Drupal Webform^AI	10/22/2026	10/22/2026	Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96370	Received	Unscored	—	—	Webform^AI	10/22/2026	10/22/2026	Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96369	Received	Unscored	—	—	Webform^AI	10/22/2026	10/22/2026	Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96368	Received	Unscored	—	—	Drupal Webform^AI	10/22/2026	10/22/2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96367	Received	Unscored	—	—	Drupal Webform^AI	10/22/2026	10/22/2026	Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96366	Received	Unscored	—	—	Webform^AI	10/22/2026	10/22/2026	Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96365	Received	Unscored	—	—	Webform^AI	10/22/2026	10/22/2026	Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96364	Received	Unscored	—	—	Drupal Webform^AI	10/22/2026	10/22/2026	Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96363	Received	Unscored	—	—	Drupal Webform^AI	10/22/2026	10/22/2026	Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96362	Received	Unscored	—	—	Drupal Webform^AI	10/22/2026	10/22/2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96361	Received	Unscored	—	—	Drupal Webform^AI	10/22/2026	10/22/2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96360	Received	Unscored	—	—	Webform^AI	10/22/2026	10/22/2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96359	Received	Unscored	—	—	Webform^AI	10/22/2026	10/22/2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96358	Received	Unscored	—	—	Drupal Webform^AI	10/22/2026	10/22/2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96357	Received	Unscored	—	—	Drupal Webform^AI	10/22/2026	10/22/2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96356	Received	Unscored	—	—	Drupal Webform^AI	10/22/2026	10/22/2026	Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96355	Received	Unscored	—	—	Drupal Webform^AI	10/22/2026	10/22/2026	Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-84921	Received	Unscored	—	—	Drupal Webform Submissions Delete^AI	10/22/2026	10/22/2026	Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.