# Drupal Webform vulnerabilities Source: https://junglewise.ai/threats/technologies/webform Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/webform.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 20 vulnerabilities in Drupal Webform: 0 in the last 7 days and 20 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-96398, was published on 22 October 2026. 20 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 20 - Last 90 days: 20 - All time: 20 (0 critical, 0 exploited in the wild) ## About Drupal Webform Drupal module for building and managing customizable web forms. ## Latest Drupal Webform vulnerabilities - [CVE-2026-96398: Drupal Webform module access bypass in submission view modes](https://junglewise.ai/threats/cve-2026-96398-drupal-contrib-2026-173-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96373: Drupal Webform access bypass in export filename validation](https://junglewise.ai/threats/cve-2026-96373-drupal-contrib-2026-168-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96372: Drupal Webform module insufficient access restriction on remote HTTP operations](https://junglewise.ai/threats/cve-2026-96372-drupal-contrib-2026-167-the-webform-module-enables-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96371: Drupal Webform module cross-site scripting in source editing](https://junglewise.ai/threats/cve-2026-96371-drupal-contrib-2026-166-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96370: Drupal Webform Submission Export/Import server-side request forgery](https://junglewise.ai/threats/cve-2026-96370-drupal-contrib-2026-164-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96369: Drupal Webform access bypass via JSON:API caching](https://junglewise.ai/threats/cve-2026-96369-drupal-contrib-2026-165-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96368: Drupal Webform cross-site scripting in tooltips and help text](https://junglewise.ai/threats/cve-2026-96368-drupal-contrib-2026-163-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96367: Drupal Webform module cross-site scripting in YAML editor](https://junglewise.ai/threats/cve-2026-96367-drupal-contrib-2026-162-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96366: Drupal Webform module insufficient file upload validation](https://junglewise.ai/threats/cve-2026-96366-drupal-contrib-2026-169-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96365: Drupal Webform denial of service via unvalidated token parameter](https://junglewise.ai/threats/cve-2026-96365-drupal-contrib-2026-170-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96364: Drupal Webform anti-spam bypass in Share submodule](https://junglewise.ai/threats/cve-2026-96364-drupal-contrib-2026-171-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96363: Drupal Webform Entity Print cross-site scripting in print templates](https://junglewise.ai/threats/cve-2026-96363-drupal-contrib-2026-161-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96362: Drupal Webform cross-site scripting in Remote Post handler](https://junglewise.ai/threats/cve-2026-96362-drupal-contrib-2026-160-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96361: Drupal Webform module cross-site scripting in text counter](https://junglewise.ai/threats/cve-2026-96361-drupal-contrib-2026-155-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96360: Drupal Webform module cross-site scripting in dynamic updates](https://junglewise.ai/threats/cve-2026-96360-drupal-contrib-2026-154-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96359: Drupal Webform color element cross-site scripting](https://junglewise.ai/threats/cve-2026-96359-drupal-contrib-2026-159-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96358: Drupal Webform rating element cross-site scripting](https://junglewise.ai/threats/cve-2026-96358-drupal-contrib-2026-158-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96357: Drupal Webform module cross-site scripting in file download handling](https://junglewise.ai/threats/cve-2026-96357-drupal-contrib-2026-172-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96356: Drupal Webform access control bypass with malformed configuration](https://junglewise.ai/threats/cve-2026-96356-drupal-contrib-2026-174-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96355: Drupal Webform template injection in token replacement](https://junglewise.ai/threats/cve-2026-96355-drupal-contrib-2026-175-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) ## Most severe Drupal Webform vulnerabilities - [CVE-2026-96398: Drupal Webform module access bypass in submission view modes](https://junglewise.ai/threats/cve-2026-96398-drupal-contrib-2026-173-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96373: Drupal Webform access bypass in export filename validation](https://junglewise.ai/threats/cve-2026-96373-drupal-contrib-2026-168-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96372: Drupal Webform module insufficient access restriction on remote HTTP operations](https://junglewise.ai/threats/cve-2026-96372-drupal-contrib-2026-167-the-webform-module-enables-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96371: Drupal Webform module cross-site scripting in source editing](https://junglewise.ai/threats/cve-2026-96371-drupal-contrib-2026-166-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96370: Drupal Webform Submission Export/Import server-side request forgery](https://junglewise.ai/threats/cve-2026-96370-drupal-contrib-2026-164-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96369: Drupal Webform access bypass via JSON:API caching](https://junglewise.ai/threats/cve-2026-96369-drupal-contrib-2026-165-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96368: Drupal Webform cross-site scripting in tooltips and help text](https://junglewise.ai/threats/cve-2026-96368-drupal-contrib-2026-163-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96367: Drupal Webform module cross-site scripting in YAML editor](https://junglewise.ai/threats/cve-2026-96367-drupal-contrib-2026-162-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96366: Drupal Webform module insufficient file upload validation](https://junglewise.ai/threats/cve-2026-96366-drupal-contrib-2026-169-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) - [CVE-2026-96365: Drupal Webform denial of service via unvalidated token parameter](https://junglewise.ai/threats/cve-2026-96365-drupal-contrib-2026-170-the-webform-module-allows-site-builders) (info, published 22 Oct 2026) ## Vulnerabilities per week 20 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 20 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Drupal technologies - [Drupal Core](https://junglewise.ai/threats/technologies/drupal-core): 17 vulnerabilities - [Drupal](https://junglewise.ai/threats/technologies/drupal): 14 vulnerabilities - [Drupal Ajenti Core](https://junglewise.ai/threats/technologies/core): 11 vulnerabilities - [Drupal AI](https://junglewise.ai/threats/technologies/drupal-ai-1): 10 vulnerabilities - [Drupal Commerce Core](https://junglewise.ai/threats/technologies/commerce-core): 4 vulnerabilities - [Drupal Commerce Stripe](https://junglewise.ai/threats/technologies/commerce-stripe): 4 vulnerabilities - [Drupal Authenticator Login Plus](https://junglewise.ai/threats/technologies/authenticator-login-plus): 3 vulnerabilities - [Drupal Commerce License](https://junglewise.ai/threats/technologies/commerce-license): 3 vulnerabilities - [Drupal Commerce](https://junglewise.ai/threats/technologies/drupal-commerce-1): 3 vulnerabilities - [Drupal Gammu SMS Daemon](https://junglewise.ai/threats/technologies/gammu-sms-daemon): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Drupal Webform vulnerabilities", https://junglewise.ai/threats/technologies/webform, 13 November 2026.