Product by Open Source
Drupal Commerce Core
39 known vulnerabilities in Drupal Commerce Core (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
39
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-10768 | LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039 | 9.8 | |
| Medium | CVE-2026-10770 | Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042 | 6.1 | |
| Medium | CVE-2026-49977 | tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies | 4.3 | |
| Medium | CVE-2026-10769 | Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041 | 5.4 | |
| Critical | CVE-2026-118539 | Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 | — | |
| Not rated | CVE-2026-118540 | Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255 | — | |
| Not rated | CVE-2026-118541 | Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256 | — | |
| Not rated | CVE-2026-118542 | Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257 | — | |
| Not rated | CVE-2026-118543 | Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258 | — | |
| Not rated | CVE-2026-118544 | Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259 | — | |
| Not rated | CVE-2026-118555 | Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260 | — | |
| Not rated | CVE-2026-118556 | Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261 | — | |
| Not rated | CVE-2026-118557 | Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262 | — | |
| Not rated | CVE-2026-118558 | Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263 | — | |
| Not rated | CVE-2026-118559 | Drupal Commerce Stripe: Improper Verification of Cryptographic Signature | — | |
| Not rated | CVE-2026-118545 | AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266 | — | |
| Not rated | CVE-2026-118546 | AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267 | — | |
| Not rated | CVE-2026-118548 | AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268 | — | |
| Not rated | CVE-2026-118549 | AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269 | — | |
| Not rated | CVE-2026-118550 | AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270 | — | |
| Not rated | CVE-2026-118551 | AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271 | — | |
| Not rated | CVE-2026-118552 | AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272 | — | |
| Not rated | CVE-2026-118553 | AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273 | — | |
| Not rated | CVE-2026-118561 | Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274 | — | |
| Not rated | CVE-2026-118562 | Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275 | — |