Hheyform

Products

Exploited and recent CVEs

• CVE-2026-102615 High 7.6 HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS 0.3%
• CVE-2026-82291 High 8.1 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials 0.6%
• CVE-2026-63429 High 8.6 HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context 0.5%
• CVE-2026-63428 Medium 5.8 HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set 0.3%
• CVE-2026-35198 Critical 9.0 HeyForm vulnerable to stored XSS via form field titles 0.5%
• CVE-2026-45797 Medium 6.4 HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload 0.6%