Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

drupal/commerce

7 known vulnerabilities (5 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 5 medium, 2 low
Registry
Packagist

Advisories 7

  • CVE-2026-118539Medium 6.5

    Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254

    Affected: fixed in 2.41.0; from 3.0.0, fixed in 3.3.13.

  • CVE-2026-118540Medium 5.3

    Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255

    Affected: fixed in 2.41.0; from 3.0.0, fixed in 3.2.0.

  • CVE-2026-118541Medium 4.3

    Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256

    Affected: fixed in 2.41.0; from 3.0.0, fixed in 3.3.13.

  • Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257

    Affected: fixed in 2.41.0; from 3.0.0, fixed in 3.3.13.

  • CVE-2026-118543Medium 5.3

    Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258

    Affected: fixed in 2.41.0; from 3.0.0, fixed in 3.3.13.

  • Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259

    Affected: fixed in 2.41.0; from 3.0.0, fixed in 3.3.13.

  • CVE-2026-10769Medium 5.4

    Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041

    Affected: from 3.3.0, fixed in 3.3.6.