Skip to content
OpenAdvisories

Package · Packagist

drupal/commerce

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • Medium 6.5
    CVE-2026-118539

    Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254

    Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 5.3
    CVE-2026-118540

    Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 4.3
    CVE-2026-118541

    Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Low 2.7
    CVE-2026-118542

    Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 5.3
    CVE-2026-118543

    Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Low 3.7
    CVE-2026-118544

    Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259

    Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 5.4
    CVE-2026-10769

    Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.

    Drupal Commerce Core drupal/commerce Packagist
  • Unscored —
    DRUPAL-CONTRIB-2021-032

    This module provides a system for building an ecommerce solution in their Drupal site. The module doesn't sufficiently …

    drupal/commerce Packagist
  • Unscored —
    DRUPAL-CONTRIB-2020-020

    Drupal Commerce is used to build eCommerce websites and applications. It's possible to configure commerce to permit ord…

    drupal/commerce Packagist
  • Unscored —
    DRUPAL-CONTRIB-2018-057

    This module enables you to build eCommerce websites and applications with Drupal. The module doesn't sufficiently check…

    drupal/commerce Packagist