What’s Vulnerable › Products

Drupal Commerce Core vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Drupal Commerce Core version is affected

Latest Drupal Commerce Core vulnerabilities

• CVE-2026-118539 — Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 (CVSS 6.5)
• CVE-2026-118540 — Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255
• CVE-2026-118541 — Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256
• CVE-2026-118542 — Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257
• CVE-2026-118543 — Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258
• CVE-2026-118544 — Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259
• CVE-2026-10769 — Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041 (CVSS 5.4)