phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

Is drupal/webform vulnerable?

Composer drupal/webform has 31 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.

31advisories
0critical
0on CISA KEV
0no fix recorded
CVETitleSeverityCVSSAffectedFixed in
CVE-2026-96355The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurablunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96365The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96356The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96366The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96398The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96364The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96367The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96370The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96372The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently restunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96371The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96360The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96373The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96359The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96357The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96358The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96361The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96369The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96362The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96363The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
CVE-2026-96368The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissiunknown0.0<6.2.12 or >=6.3.0 <6.3.16.2.12, 6.3.1
DRUPAL-CONTRIB-2020-011This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently filter webform element prunknown0.0<5.11.05.11.0
DRUPAL-CONTRIB-2020-012This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently validate data submitted iunknown0.0<5.11.05.11.0
DRUPAL-CONTRIB-2020-013The Webform module allows site builders to create forms. The module doesn't sufficiently prevent malicious code from beunknown0.0<5.11.05.11.0
DRUPAL-CONTRIB-2020-014This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently filter user input under iunknown0.0<5.11.05.11.0
DRUPAL-CONTRIB-2020-015This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently sanitize Webform labels nunknown0.0<5.11.05.11.0
DRUPAL-CONTRIB-2020-016This webform module enables you to build 'Term select' and 'Term checkboxes' elements. The module doesn't sufficientlyunknown0.0<5.11.05.11.0
DRUPAL-CONTRIB-2020-017This module enables you to build forms and surveys in Drupal. The Webform Node sub-module allows these forms to be assounknown0.0<5.11.05.11.0
DRUPAL-CONTRIB-2020-018This webform module enables you to build a 'Term checkboxes' element. The module doesn't sufficiently check term 'view'unknown0.0<5.12.05.12.0
DRUPAL-CONTRIB-2021-004The [Webform module for Drupal 8/9](https://www.drupal.org/project/webform) includes a default Contact webform, which seunknown0.0<5.25.0 or 6.0.0 or 6.0.15.25.0
DRUPAL-CONTRIB-2021-026The Webform module uses the [CKEditor](https://github.com/ckeditor/ckeditor4), library for WYSIWYG editing. CKEditor hasunknown0.0<5.28.0 or >=6.0.0 <6.0.55.28.0, 6.0.5
DRUPAL-CONTRIB-2021-045### Access Bypass: This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently checkunknown0.0>=6.0.0 <6.0.6 or >=6.1.0 <6.1.26.0.6, 6.1.2

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs   How findings are ranked
A version is vulnerable when it falls inside an affected range and below the fixed version. phpwarden applies these ranges to the exact versions in your lockfile or install, so you only see what applies to you.