Webform

Every one of the 20 is a mark on the map. Named now: 1 to 20, most at risk first.

1. Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175CVE-2026-96355Drupal · CVSS 9.1 · 0.4% likely

   CWE-1336

2. Webform - Less critical - Denial of service - SA-CONTRIB-2026-170CVE-2026-96365Drupal · CVSS 7.5 · 0.4% likely

   CWE-770

3. Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174CVE-2026-96356Drupal · CVSS 5.3 · 0.4% likely

   CWE-863

4. Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169CVE-2026-96366Drupal · CVSS 5.3 · 0.4% likely

   CWE-863

5. Webform - Less critical - Access bypass - SA-CONTRIB-2026-173CVE-2026-96398Drupal · CVSS 4.3 · 0.3% likely

   CWE-863

6. Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171CVE-2026-96364Drupal · CVSS 5.3 · 0.3% likely

   CWE-799

7. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162CVE-2026-96367Drupal · CVSS 4.6 · 0.3% likely

   CWE-267

8. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161CVE-2026-96363Drupal · CVSS 3.1 · 0.2% likely

   CWE-267

9. Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167CVE-2026-96372Drupal · CVSS 5.4 · 0.2% likely

   CWE-1220

10. Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164CVE-2026-96370Drupal · CVSS 5.4 · 0.2% likely

    CWE-863

11. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166CVE-2026-96371Drupal · CVSS 5.4 · 0.2% likely

    CWE-267

12. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154CVE-2026-96360Drupal · CVSS 3.5 · 0.2% likely

    CWE-79

13. Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168CVE-2026-96373Drupal · CVSS 3.3 · 0.2% likely

    CWE-863

14. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159CVE-2026-96359Drupal · CVSS 4.6 · 0.2% likely

    CWE-79

15. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155CVE-2026-96361Drupal · CVSS 4.6 · 0.2% likely

    CWE-79

16. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158CVE-2026-96358Drupal · CVSS 4.6 · 0.2% likely

    CWE-79

17. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172CVE-2026-96357Drupal · CVSS 4.6 · 0.2% likely

    CWE-79

18. Webform - Less critical - Access bypass - SA-CONTRIB-2026-165CVE-2026-96369Drupal · CVSS 3.1 · 0.2% likely

    CWE-525

19. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160CVE-2026-96362Drupal · CVSS 4.2 · 0.2% likely

    CWE-79

20. Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163CVE-2026-96368Drupal · CVSS 4.6 · 0.2% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.