Threat database

CVE-2026-96363 is a vulnerability in the Drupal Webform module where a privilege is defined with unsafe actions, leading to a Stored Cross-Site Scripting (XSS) issue. This affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability allows an attacker with the affected privilege to inject persistent malicious scripts. No CVSS score is provided, and no known exploits are reported in the wild.

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

An incorrect authorization vulnerability in the Drupal Webform module allows forceful browsing. This affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1. The vulnerability has a low severity with a CVSS score of 3.3, indicating limited impact on confidentiality and integrity and no impact on availability.

An incorrect authorization vulnerability in the Drupal Webform module allows unauthorized users to perform forceful browsing. This affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1. The vulnerability has a CVSS score of 5.3, indicating medium severity, with impact limited to information disclosure (confidentiality loss) and no impact on integrity or availability.

CVE-2026-96365 is a high-severity vulnerability in the Drupal Webform module that allows excessive allocation of resources due to lack of limits or throttling. It affects Webform versions from 0.0.0 up to 6.2.12 and from 6.3.0 to 6.3.1. This vulnerability can cause denial of service by exhausting system resources. There is no explicit patch or remediation information provided in the source data.

An Improper Control of Interaction Frequency vulnerability (CWE-799) exists in Drupal Webform, allowing functionality misuse. This affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1. The vulnerability has a medium severity with a CVSS score of 5.3. There is no information about available patches or vendor advisories. No known exploits are reported in the wild.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal Webform module, affecting versions from 0.0.0 up to 6.2.12 and from 6.3.0 to 6.3.1. This vulnerability is due to improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that can be stored and executed in users' browsers. The vulnerability has a medium severity rating with a CVSS score of 4.6.

An incorrect authorization vulnerability in the Drupal Webform module allows forceful browsing, potentially enabling unauthorized users with limited privileges to access restricted resources. The issue affects Webform versions from 0.0.0 up to 6.2.12 and from 6.3.0 to 6.3.1. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.

An Incorrect Authorization vulnerability in the Drupal Webform module allows forceful browsing, potentially exposing information without proper access control. This affects Webform versions from 0.0.0 up to 6.2.12 and from 6.3.0 to 6.3.1. The vulnerability has a medium severity with a CVSS score of 5.3.

A critical vulnerability in Drupal Webform allows code injection due to improper neutralization of special elements used in its template engine. This affects Webform versions from 0.0.0 up to 6.2.12 and from 6.3.0 to 6.3.1. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality and integrity without requiring user interaction or privileges.

An improper certificate validation vulnerability in Drupal Cloud versions up to 7.0.1 allows an adversary to perform man-in-the-middle (AiTM) attacks. The vulnerability has a medium severity with a CVSS score of 4.8. It affects cloud versions from 0.0.0 through 7.0.1. No patch or remediation information is provided, and no known exploits are reported in the wild.

An OS Command Injection vulnerability (CVE-2026-96376) exists in Drupal Cloud versions from 0.0.0 up to 7.0.1 due to improper neutralization of special elements in OS commands. This vulnerability allows an attacker with low privileges and requiring user interaction to execute arbitrary OS commands, potentially leading to high confidentiality and integrity impact but no availability impact. The vulnerability has a CVSS 3.1 score of 6.4, indicating medium severity.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Drupal Project Browser module, affecting versions from 0.0.0 to 2.0.3 and 2.1.0 to 2.1.5. This vulnerability allows an attacker to trick a user into performing unwanted actions on the affected application. The CVSS score is 4.2, indicating a medium severity level.

A vulnerability in Drupal Commerce Decoupled Checkout versions 1.0.0 through 1.8.0 allows improper modification of dynamically-determined object attributes, leading to object injection. The issue is identified as CWE-915 and has a medium severity with a CVSS score of 4.3. No known exploits are reported in the wild, and no patch or remediation details are currently provided.

An incorrect authorization vulnerability exists in the Drupal Mermaid Diagram Field module versions 1.0.4 through 1.0.9. This flaw allows forceful browsing, potentially enabling users with limited privileges to access unauthorized resources. The vulnerability has a low severity rating with a CVSS score of 3.5.