# Packagist:Https://Packages.drupal.org/8 Drupal/Webform vulnerabilities Source: https://junglewise.ai/threats/technologies/drupal-webform Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/drupal-webform.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 31 vulnerabilities in Packagist:Https://Packages.drupal.org/8 Drupal/Webform: 0 in the last 7 days and 20 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-96398, was published on 22 October 2026. 20 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 20 - Last 90 days: 20 - All time: 31 (0 critical, 0 exploited in the wild) ## About Packagist:Https://Packages.drupal.org/8 Drupal/Webform Drupal module for building, managing, and processing web forms with advanced field and submission options. ## Latest Packagist:Https://Packages.drupal.org/8 Drupal/Webform vulnerabilities - [CVE-2026-96398: Drupal Webform module access bypass in submission view modes](https://junglewise.ai/threats/cve-2026-96398-drupal-contrib-2026-173-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96373: Drupal Webform access bypass in export filename validation](https://junglewise.ai/threats/cve-2026-96373-drupal-contrib-2026-168-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96372: Drupal Webform module insufficient access restriction on remote HTTP operations](https://junglewise.ai/threats/cve-2026-96372-drupal-contrib-2026-167-the-webform-module-enables-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96371: Drupal Webform module cross-site scripting in source editing](https://junglewise.ai/threats/cve-2026-96371-drupal-contrib-2026-166-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96370: Drupal Webform Submission Export/Import server-side request forgery](https://junglewise.ai/threats/cve-2026-96370-drupal-contrib-2026-164-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96369: Drupal Webform access bypass via JSON:API caching](https://junglewise.ai/threats/cve-2026-96369-drupal-contrib-2026-165-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96368: Drupal Webform cross-site scripting in tooltips and help text](https://junglewise.ai/threats/cve-2026-96368-drupal-contrib-2026-163-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96367: Drupal Webform module cross-site scripting in YAML editor](https://junglewise.ai/threats/cve-2026-96367-drupal-contrib-2026-162-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96366: Drupal Webform module insufficient file upload validation](https://junglewise.ai/threats/cve-2026-96366-drupal-contrib-2026-169-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96365: Drupal Webform denial of service via unvalidated token parameter](https://junglewise.ai/threats/cve-2026-96365-drupal-contrib-2026-170-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96364: Drupal Webform anti-spam bypass in Share submodule](https://junglewise.ai/threats/cve-2026-96364-drupal-contrib-2026-171-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96363: Drupal Webform Entity Print cross-site scripting in print templates](https://junglewise.ai/threats/cve-2026-96363-drupal-contrib-2026-161-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96362: Drupal Webform cross-site scripting in Remote Post handler](https://junglewise.ai/threats/cve-2026-96362-drupal-contrib-2026-160-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96361: Drupal Webform module cross-site scripting in text counter](https://junglewise.ai/threats/cve-2026-96361-drupal-contrib-2026-155-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96360: Drupal Webform module cross-site scripting in dynamic updates](https://junglewise.ai/threats/cve-2026-96360-drupal-contrib-2026-154-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96359: Drupal Webform color element cross-site scripting](https://junglewise.ai/threats/cve-2026-96359-drupal-contrib-2026-159-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96358: Drupal Webform rating element cross-site scripting](https://junglewise.ai/threats/cve-2026-96358-drupal-contrib-2026-158-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96357: Drupal Webform module cross-site scripting in file download handling](https://junglewise.ai/threats/cve-2026-96357-drupal-contrib-2026-172-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96356: Drupal Webform access control bypass with malformed configuration](https://junglewise.ai/threats/cve-2026-96356-drupal-contrib-2026-174-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96355: Drupal Webform template injection in token replacement](https://junglewise.ai/threats/cve-2026-96355-drupal-contrib-2026-175-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [DRUPAL-CONTRIB-2021-045 - ### Access Bypass: This module enables you to build forms and surveys in Drupal. The module…](https://junglewise.ai/threats/drupal-contrib-2021-045-access-bypass-this-module-enables-you-to-build-30710668) (info, published 8 Dec 2021) - [DRUPAL-CONTRIB-2021-026 - The Webform module uses the CKEditor(https://github.com/ckeditor/ckeditor4), library for…](https://junglewise.ai/threats/drupal-contrib-2021-026-the-webform-module-uses-the-ckeditor-https-f23f63d5) (info, published 25 Aug 2021) - [DRUPAL-CONTRIB-2021-004 - The Webform module for Drupal 8/9(https://www.drupal.org/project/webform) includes a…](https://junglewise.ai/threats/drupal-contrib-2021-004-the-webform-module-for-drupal-8-9-https-www-51b49bb7) (info, published 3 Mar 2021) - [DRUPAL-CONTRIB-2020-018 - This webform module enables you to build a 'Term checkboxes' element. The module doesn't…](https://junglewise.ai/threats/drupal-contrib-2020-018-this-webform-module-enables-you-to-build-a-term-a92ad862) (info, published 13 May 2020) - [DRUPAL-CONTRIB-2020-017 - This module enables you to build forms and surveys in Drupal. The Webform Node sub-module…](https://junglewise.ai/threats/drupal-contrib-2020-017-this-module-enables-you-to-build-forms-and-49065d49) (info, published 6 May 2020) ## Most severe Packagist:Https://Packages.drupal.org/8 Drupal/Webform vulnerabilities - [CVE-2026-96398: Drupal Webform module access bypass in submission view modes](https://junglewise.ai/threats/cve-2026-96398-drupal-contrib-2026-173-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96373: Drupal Webform access bypass in export filename validation](https://junglewise.ai/threats/cve-2026-96373-drupal-contrib-2026-168-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96372: Drupal Webform module insufficient access restriction on remote HTTP operations](https://junglewise.ai/threats/cve-2026-96372-drupal-contrib-2026-167-the-webform-module-enables-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96371: Drupal Webform module cross-site scripting in source editing](https://junglewise.ai/threats/cve-2026-96371-drupal-contrib-2026-166-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96370: Drupal Webform Submission Export/Import server-side request forgery](https://junglewise.ai/threats/cve-2026-96370-drupal-contrib-2026-164-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96369: Drupal Webform access bypass via JSON:API caching](https://junglewise.ai/threats/cve-2026-96369-drupal-contrib-2026-165-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96368: Drupal Webform cross-site scripting in tooltips and help text](https://junglewise.ai/threats/cve-2026-96368-drupal-contrib-2026-163-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96367: Drupal Webform module cross-site scripting in YAML editor](https://junglewise.ai/threats/cve-2026-96367-drupal-contrib-2026-162-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96366: Drupal Webform module insufficient file upload validation](https://junglewise.ai/threats/cve-2026-96366-drupal-contrib-2026-169-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96365: Drupal Webform denial of service via unvalidated token parameter](https://junglewise.ai/threats/cve-2026-96365-drupal-contrib-2026-170-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) ## Vulnerabilities per week 20 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 20 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist:Https://Packages.drupal.org/8 technologies - [Packagist:Https://Packages.drupal.org/8 Drupal/Ai](https://junglewise.ai/threats/technologies/drupal-ai): 18 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Social](https://junglewise.ai/threats/technologies/drupal-social): 16 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Miniorange Saml](https://junglewise.ai/threats/technologies/drupal-miniorange-saml): 15 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Commerce](https://junglewise.ai/threats/technologies/drupal-commerce): 10 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Miniorange 2fa](https://junglewise.ai/threats/technologies/drupal-miniorange-2fa): 7 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Jsonapi](https://junglewise.ai/threats/technologies/drupal-jsonapi): 6 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Permissions By Term](https://junglewise.ai/threats/technologies/drupal-permissions-by-term): 6 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Auth Login Plus](https://junglewise.ai/threats/technologies/drupal-auth-login-plus): 5 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Cookies](https://junglewise.ai/threats/technologies/drupal-cookies): 5 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Facets](https://junglewise.ai/threats/technologies/drupal-facets): 5 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Gutenberg](https://junglewise.ai/threats/technologies/drupal-gutenberg): 5 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Tfa](https://junglewise.ai/threats/technologies/drupal-tfa): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Packagist:Https://Packages.drupal.org/8 Drupal/Webform vulnerabilities", https://junglewise.ai/threats/technologies/drupal-webform, 13 November 2026.