p PatchFirst

PatchFirst · Latest vulnerabilities

PHP stack vulnerabilities · Page 3

Vulnerabilities published for PHP in the last 30 days: 194. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
PHP

Vulnerabilities: 7182

  1. CVE-2026-96362

    Medium · CVSS 4.2EPSS 0.16%Fix available

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2026-96363

    Not ratedEPSS 0.19%Fix available

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2026-96367

    Medium · CVSS 4.6EPSS 0.22%Fix available

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-96368

    Medium · CVSS 4.6EPSS 0.23%Fix available

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-96370

    Medium · CVSS 5.4EPSS 0.25%Fix available

    Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

    Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2026-96369

    Low · CVSS 3.1EPSS 0.24%Fix available

    Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2026-96371

    Medium · CVSS 5.4EPSS 0.18%Fix available

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2026-96372

    Medium · CVSS 5.4EPSS 0.25%Fix available

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167

    Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2026-96373

    Low · CVSS 3.3EPSS 0.18%Fix available

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2026-96366

    Medium · CVSS 5.3EPSS 0.34%Fix available

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2026-96365

    High · CVSS 7.5EPSS 0.46%Fix available

    Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  12. CVE-2026-96364

    Medium · CVSS 5.3EPSS 0.23%Fix available

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171

    Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2026-96357

    Medium · CVSS 4.6EPSS 0.17%Fix available

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2026-96398

    Medium · CVSS 4.3EPSS 0.23%Fix available

    Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  15. CVE-2026-96356

    Medium · CVSS 5.3EPSS 0.34%Fix available

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2026-96355

    Critical · CVSS 9.1EPSS 0.43%Fix available

    Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Update to 6.2.12
    • Update to 6.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  17. CVE-2026-96375

    Medium · CVSS 4.8EPSS 0.09%Fix available

    Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

    Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.

    cloud drupal/cloudPHP
    • Update to 7.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  18. CVE-2026-96376

    Medium · CVSS 6.4EPSS 0.57%Fix available

    Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

    Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.

    cloud drupal/cloudPHP
    • Update to 7.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2026-96374

    Medium · CVSS 4.2EPSS 0.08%Fix available

    Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.

    project browser drupal/project_browserPHP
    • Update to 2.0.3
    • Update to 2.1.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  20. CVE-2026-96378

    Medium · CVSS 4.3EPSS 0.3%Fix available

    Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.

    commerce decoupled checkout drupal/commerce_decoupled_checkoutPHP
    • Update to 1.8.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →