TI-2026-45208 CVE-2026-63429
HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context
Priority HIGH 76
HeyForm is an open-source form builder.
heyform
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
heyform records in CISA KEVNo heyform vulnerabilities are listed in CISA KEV.
Records
6 records
Priority HIGH 74
HeyForm is an open-source form builder.
TI-2026-56756 CVE-2026-82291 · GHSA-69g7-vm8m-997r
HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials
Priority HIGH 70
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication.
TI-2026-45207 CVE-2026-63428
Improper input validation in heyform
Priority HIGH 65
HeyForm is an open-source form builder.
Priority LOW 35
HeyForm is an open-source form builder.
Priority LOW 33
HeyForm is an open-source form builder.