NewsThe Hacker News
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Linked advisories
- CVE-2026-118539Drupal Commerce Core access bypass actively exploited (CVE-2026-118539, SA-CONTRIB-2026-254)
- CVE-2026-118539Drupal Commerce Core: fehlende Autorisierung
- CVE-2026-118539Drupal Commerce Core: fehlende Autorisierung
- CVE-2026-118539OSV-Eintrag
- CVE-2026-118539Drupal Erweiterungen: Mehrere Schwachstellen
Affected vendors and products
- Drupal Commerce Core
- Open Source Drupal AI
- Open Source Drupal Bulk Update User Roles
- Open Source Drupal Captcha
- Open Source Drupal Commerce Core
- Open Source Drupal Commerce License
- Open Source Drupal Commerce Shipping
- Open Source Drupal Commerce Stripe
- Open Source Drupal Content Sync
- Open Source Drupal Fasttoggle
- Open Source Drupal Field Permissions
- Open Source Drupal Media Alias Display
More on Authorization
Other advisories
- HighCVE-2026-111493Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifier…
- MediumCVE-2026-115298Incorrect Authorization in Elasticsearch Leading to Information Disclosure
- CriticalCVE-2026-115732Debian LTS trapperkeeper-authorization-clojure: security update
- MediumCVE-2026-20241Cisco Identity Services Engine Authorization Bypass Vulnerability
- MediumCVE-2026-99225keys: Check the authorization payload in process keyring searches
- CriticalCVE-2026-115732Debian trapperkeeper-authorization-clojure: security update
- Not ratedosv:CVE-2026-121585InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization
- Not ratedosv:CVE-2026-121582Umami Record API Endpoint route.ts authorization
Other news entries
- Cisco Identity Services Engine Authorization Bypass VulnerabilityNewsCisco PSIRT
- Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated CriticalNewsSecurityWeek
- Barracuda’s security appliances have a security problem of their ownNewsCSO Online
- Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root AccessNewsThe Hacker News
- b14g: about 97M CORE drained from its Core staking contracts; contracts pausedBreachpwn.watch
- Chainalysis breach: all-customer password hashes and live tokens exposed; Reactor, KYT and Address Screening back onlineBreachpwn.watch
- Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesNewsSecurityWeek
- Binance says a fake job interview started its $6.3B hack; it has rebuilt the affected wallet system and will cover all lossesBreachpwn.watch
Source: https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html
ID