These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-63429 is an unauthenticated file upload vulnerability in HeyForm, an open-source form builder. The vulnerability exists in the `POST /api/upload` endpoint, which lacks authentication, global guards, form-context validation, `openToken` requirements, and session cookie checks. This allows any anonymous internet user to upload files, including PDFs, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, and images, up [truncated]
CVE-2026-63428 is a vulnerability in HeyForm, an open-source form builder. The `completeSubmission` function accepts a `hiddenFields` array from the submitter and stores it without validating the supplied `id`/`name` against the form's declared `form.hiddenFields` schema. This allows an anonymous form submitter to inject arbitrary key/value pairs, including potential XSS payloads, fake authorization metad [truncated]
CVE-2026-45797 is a stored cross-site scripting (XSS) vulnerability in HeyForm, an open-source form builder. The vulnerability exists in the `/api/upload` endpoint, which allows unauthenticated file uploads, including SVG files. These uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by Express's serve-static middleware. This allows an attacker to achiev [truncated]
A stored cross-site scripting (XSS) vulnerability in HeyForm's form builder allows low-privileged team members to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. The issue was patched in version 3.0.0-rc.7. This vulnerability affects users of HeyForm, especially those with low-privileged team members, and could [truncated]