Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    DRUPAL-CONTRIB-2026-171 (CVE-2026-96364)

    Vulnerability from drupal – Published: 2026-09-23 16:26 – Updated: 2026-09-23 16:46 – Source website
    VLAI
    Details

    The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

    The Webform Share submodule can expose a webform for embedding on another site.

    Under certain circumstances, submissions for an Ajax-enabled Webform using Webform Share can bypass anti-spam protections.

    This vulnerability is mitigated by the fact that Webform Share must be enabled, sharing must be enabled for the affected webform, and the affected webform must rely on compatible Form-API-based anti-spam protections such as Honeypot or Antibot.

    Credits
    karing www.drupal.org/u/karing
    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c6.2.12 || \u003e=6.3.0 \u003c6.3.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/webform"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c6.2.12"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.2.12"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=6.3.0 \u003c6.3.1"
          },
          "events": [
            {
              "introduced": "6.3.0"
            },
            {
              "fixed": "6.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-96364"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/karing"
      ],
      "name": "karing"
    }
  ],
  "details": "The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.\n\nThe Webform Share submodule can expose a webform for embedding on another site.\n\nUnder certain circumstances, submissions for an Ajax-enabled Webform using Webform Share can bypass anti-spam protections.\n\nThis vulnerability is mitigated by the fact that Webform Share must be enabled, sharing must be enabled for the affected webform, and the affected webform must rely on compatible Form-API-based anti-spam protections such as Honeypot or Antibot.",
  "id": "DRUPAL-CONTRIB-2026-171",
  "modified": "2026-09-23T16:46:40.000Z",
  "published": "2026-09-23T16:26:32.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-171"
    }
  ],
  "schema_version": "1.7.0"
}