commerce_core vulnerabilities
CVEs whose affected-version data names the commerce_core package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-118540NoneCommerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.
CVE-2026-118542NoneCommerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118541NoneCommerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118544NoneCommerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118543NoneCommerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.