https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-23T11:18:23.140051+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/drupal-contrib-2026-159 DRUPAL-CONTRIB-2026-159 2026-10-23T11:18:23.174864+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/webform

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module did not sufficiently sanitize attributes used by its color element. Under certain conditions, specially crafted attributes could result in cross-site scripting (XSS) when the element is rendered.

This vulnerability is mitigated by the fact that an attacker must be able to add a specially crafted link with a specific class to the same page as the affected webform.

 https://db.gcve.eu/vuln/fkie_cve-2026-96359 fkie_cve-2026-96359 2026-10-23T11:18:23.174946+00:00

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

 https://db.gcve.eu/vuln/ghsa-vc46-8rqj-39vr GHSA-vc46-8rqj-39vr 2026-10-23T11:18:23.174988+00:00

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

 https://db.gcve.eu/vuln/wid-sec-w-2026-3554 WID-SEC-W-2026-3554 — Drupal Erweiterungen: Mehrere Schwachstellen 2026-10-23T11:18:23.175011+00:00

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.