https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-30T16:37:44.328633+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/drupal-contrib-2026-259 DRUPAL-CONTRIB-2026-259 2026-10-30T16:37:44.348230+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/commerce

This module enables you to sell goods and services to customers through a shopping cart and checkout form.

The module doesn't sufficiently restrict the product variations returned by entity queries to the variations the current user can view. When the core JSON:API module is enabled, a visitor can make repeated requests that eventually determine certain field values on an unpublished product variation, or a variation of an unpublished product.

This vulnerability is mitigated by the fact that the core JSON:API module must be enabled.

 https://db.gcve.eu/vuln/fkie_cve-2026-118544 fkie_cve-2026-118544 2026-10-30T16:37:44.348446+00:00

Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

 https://db.gcve.eu/vuln/ghsa-v5mv-g539-3hqf GHSA-v5mv-g539-3hqf 2026-10-30T16:37:44.348554+00:00

Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

 https://db.gcve.eu/vuln/wid-sec-w-2026-4230 WID-SEC-W-2026-4230 — Drupal Erweiterungen: Mehrere Schwachstellen 2026-10-30T16:37:44.348620+00:00

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.