Webform (Versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/webform-versions-0.0.0-to-6.2.12-and-6.3.0-to-6.3.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 16:14:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDrupal Webform: Code injection via template engine (CVE-2026-96355)https://feed.craftedsignal.io/briefs/2026-10-drupal-webform-code-injection/Thu, 22 Oct 2026 16:14:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-drupal-webform-code-injection/The Drupal Webform module is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability, which allows for Code Injection.<p>Drupal Webform is affected by a vulnerability identified as CVE-2026-96355. This issue involves the improper neutralization of special elements within the module's template engine, resulting in Code Injection. This vulnerability affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.</p> criticaladvisoryweb-applicationdrupalcve-2026-96365