Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11CVE-2026-96359 is a cross-site scripting (XSS) vulnerability in the contributed Drupal Webform project, not in Drupal core. Drupal’s official advisory says the issue affects Webform’s color element when specially crafted attributes are rendered, and gives branch-specific fixes: Webform 6.2.12 or 6.3.1. The available official sources do not establish the contents of CERT-Bund advisory WID-SEC-2026-3554 or confirm how it relates to this CVE, so treat claims about that relationship as unverified.
What CVE-2026-96359 affects
Drupal’s security advisory SA-CONTRIB-2026-159, published September 23, 2026, identifies CVE-2026-96359 as a moderately critical XSS vulnerability in the contributed Webform project. Webform did not sufficiently sanitize attributes used by its color element; under certain conditions, specially crafted attributes can lead to XSS when the element is rendered.
As an Amazon Associate I earn from qualifying purchases.
This is a Webform issue, not a Drupal core vulnerability. Drupal’s announcement for the September 23 contributed-project security release likewise said Drupal core was not affected by that release. That release context does not mean every contributed project in it had the same flaw or severity.
When the vulnerability can be triggered
The advisory describes a specific prerequisite: an attacker must be able to add a specially crafted link with a particular class to the same page as the affected Webform. In practical terms, the issue is not described as something triggered merely by sending an arbitrary request to a site that uses Webform. Defenders should assess whether an attacker can introduce that link in the relevant page context, alongside checking whether an affected Webform version is installed.
#1 Best Overall
Drupal assigns this individual issue a risk rating of Moderately critical, 12/25. That rating belongs to SA-CONTRIB-2026-159; it should not be confused with a score attributed to a broader advisory batch.
Which Webform versions are affected and what to install
Drupal lists two affected ranges and provides a fixed release for each branch. Compare the installed Webform version with these ranges, then update to the corresponding release:
| Installed branch | Affected versions | Drupal’s fix |
|---|---|---|
| 6.2.x | Below 6.2.12 | Webform 6.2.12 |
| 6.3.x | 6.3.0 and below 6.3.1 | Webform 6.3.1 |
These ranges and fixes are from Drupal’s official Webform advisory. The advisory’s listed ranges do not establish the status of versions or branches outside them; consult the project’s current guidance if your installation does not match either range.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What WID-SEC-2026-3554 does—and does not—establish here
CERT-Bund’s WID service describes its role as publishing information about vulnerabilities, patches, and workarounds. Its service description does not establish the contents of the specific record WID-SEC-2026-3554. The direct record was not available among the sources that establish the CVE facts in this article.
Rank #3
Drupal’s official advisory maps CVE-2026-96359 to Webform, but the available official material does not confirm that this CVE appears in WID-SEC-2026-3554 or explain the relationship between the two identifiers. Claims that the WID record aggregates a particular number of CVEs or projects, or assigns a particular batch score or fixed-version list, therefore should not be treated as verified on this evidence. Do not use a purported batch rating as the severity of CVE-2026-96359.
Drupal’s September 21, 2026 release announcement said a contributed-project security release was scheduled for September 23 and that Drupal core was not affected by that release. That announcement provides release context; it does not by itself verify a CERT-Bund WID entry or establish that this Webform vulnerability was part of that WID record.
Quick Recap
Best Value
Defender checklist
- Identify the installed Webform version and determine whether it falls within one of Drupal’s affected ranges.
- Update 6.2.x installations below 6.2.12 to 6.2.12, or 6.3.x installations from 6.3.0 to 6.3.1.
- Assess whether an attacker can add the specially crafted link with the specified class to the page containing the affected form.
- Use SA-CONTRIB-2026-159 for the CVE’s component, conditions, severity, and branch-specific fixes. Do not infer the contents of WID-SEC-2026-3554 from the CVE number alone.
- If you need to rely on the WID identifier for tracking or reporting, confirm its entry directly with CERT-Bund before asserting that it includes this CVE or assigning it batch-level details.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
