Advisories · Technology
Drupal Commerce Core.
Every CVE that names Drupal Commerce Core among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
- Drupal Commerce Core
- Broken access control
-
Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255
- Drupal Commerce Core
- Broken access control
-
Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256
- Drupal Commerce Core
- Broken access control
-
Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257
- Drupal Commerce Core
- Broken access control
-
Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258
- Drupal Commerce Core
- Cross-site request forgery (CSRF)
-
Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259
- Drupal Commerce Core
- CWE-202
- CVSS 5.4 Medium
Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041
- Drupal Commerce Core
- Cross-site scripting (XSS)