Vulnerabilities in heyform
6 resultsCVE-2026-45797MEDIUMHeyForm Vulnerable to Stored XSS via Unauthenticated SVG File UploadEPSS 0.6%CVE-2026-82291HIGHHeyForm Reflects Any Origin in CORS Responses While Allowing CredentialsEPSS 0.6%CVE-2026-63429HIGHHeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form contextEPSS 0.5%CVE-2026-35198CRITICALHeyForm vulnerable to stored XSS via form field titlesEPSS 0.5%CVE-2026-63428MEDIUMHeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field setEPSS 0.3%CVE-2026-102615HIGHHeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSSEPSS 0.3%