CVE-2026-96367
NoneCVSS
—
EPSS
0.2%
Published
Oct 22, 2026
CISA due date
—
The record
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-96390 Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility… CWE-267
- CVE-2026-96371 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. CWE-267
- CVE-2026-96363 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. CWE-267
- CVE-2026-18858 IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from… CWE-267
- CVE-2026-10090 A flaw was found in the Application Subscription controller… CWE-267
- CVE-2026-6816 An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the… CWE-267
- CVE-2026-9560 Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on… CWE-267
- CVE-2026-42406 A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged… CWE-267