heyform vulnerabilities
6 published CVEs name heyform among the affected products.
- 6Published CVEs6 of them scored
- 6Last 12 monthspublished in the last year
- 1Critical3 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-102615
HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS
heyform · heyform
High7.6 - CVE-2026-82291
HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials
heyform · heyform
High8.1 - CVE-2026-63429
HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context
heyform · heyform
High8.6 - CVE-2026-63428
HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set
heyform · heyform
Medium5.8 - CVE-2026-35198
HeyForm vulnerable to stored XSS via form field titles
heyform · heyform
Critical9.0 - CVE-2026-45797
HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload
heyform · heyform
Medium6.4