Most recent entries from all

DRUPAL-CONTRIB-2026-258

2026-10-30T22:30:48.022840+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/commerce

This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates.

Routes for the inbox do not check for a CSRF token. As a result, an attacker can trick a user with the "access commerce administration pages" permission into visiting a crafted page that will dismiss notifications for the messages. The inbox is also shared by all users, so if one commerce administrator is tricked, this hides the messages from every administrator, including notices that a security update is available.

fkie_cve-2026-118543

2026-10-30T22:30:48.022921+00:00

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

GHSA-h38c-8g33-pr7c

2026-10-30T22:30:48.022950+00:00

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

WID-SEC-W-2026-4230 — Drupal Erweiterungen: Mehrere Schwachstellen

2026-10-30T22:30:48.022965+00:00

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.