https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-31T06:23:09.314324+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/drupal-contrib-2026-260 DRUPAL-CONTRIB-2026-260 2026-10-31T06:23:09.335034+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/commerce_license

This module enables you to sell licenses granting access to resources, such as user roles, files, or protected content.

The module doesn't sufficiently restrict access to license fields for users with the "update own commerce\_license" permission. A license owner can change the rights granted by their license and the license state, which can result in privilege escalation, up to the Administrator role for the site.

This vulnerability is mitigated by the fact that an attacker must own a license, and have a role with the "update own commerce\_license" permission, which is not granted by default.

 https://db.gcve.eu/vuln/fkie_cve-2026-118555 fkie_cve-2026-118555 2026-10-31T06:23:09.335099+00:00

Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.

 https://db.gcve.eu/vuln/ghsa-jv69-g96x-2r4w GHSA-jv69-g96x-2r4w 2026-10-31T06:23:09.335126+00:00

Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.

 https://db.gcve.eu/vuln/wid-sec-w-2026-4230 WID-SEC-W-2026-4230 — Drupal Erweiterungen: Mehrere Schwachstellen 2026-10-31T06:23:09.335141+00:00

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.