https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T02:44:15.220984+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-35198 CVE-2026-35198 — HeyForm vulnerable to stored XSS via form field titles 2026-10-07T02:44:15.238221+00:00

Affected: heyform

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.