Webform vulnerabilities

2 known vulnerabilities in Webform from Drupal. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Webform: Allocation of Resources Without Limits or Throttling

  CVE-2026-96365Oct 22, 2026Drupal

  Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

• 9.1 Critical severity

  Webform: Improper Neutralization of Special Elements Used in a Template Engine

  CVE-2026-96355Oct 22, 2026Drupal

  Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.