drupal Commerce Core vulnerabilities

Latest drupal Commerce Core CVEs

Newest publication first

1. CVE-2026-118539 Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254

   Published 2026-10-30

   Medium·CVSS 6.5 EPSS 0.67%

   Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

2. CVE-2026-118540 Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255

   Published 2026-10-30

   Medium·CVSS 5.3 EPSS 0.24%

   Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.

3. CVE-2026-118541 Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256

   Published 2026-10-30

   Medium·CVSS 4.3 EPSS 0.19%

   Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

4. CVE-2026-118542 Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257

   Published 2026-10-30

   Low·CVSS 2.7 EPSS 0.21%

   Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

5. CVE-2026-118543 Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258

   Published 2026-10-30

   Medium·CVSS 5.3 EPSS 0.16%

   Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

6. CVE-2026-118544 Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259

   Published 2026-10-30

   Low·CVSS 3.7 EPSS 0.20%

   Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

7. CVE-2026-10769 Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041

   Published 2026-07-10

   Medium·CVSS 5.4 EPSS 0.23%

   Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.