formbricks has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 5.9 (medium).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.9
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-105090Medium· 5.1Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS40CVE-2026-110620Medium· 6.8Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId38
formbricks vulnerabilities
CVEs affecting formbricks, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-110620Medium· 6.8Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or m…
▾ Sunlitformbricks · formbricksEPSS 0.56%via NVD
CVE-2026-105090Medium· 5.1PoCFormbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Cu…
▾ TwilightFormbricks · FormbricksEPSS 0.33%via NVD