https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 30 Oct 2026 13:23:22 +0000 https://db.gcve.eu/vuln/drupal-contrib-2026-258 <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/commerce</p> <p>This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates.</p> <p>Routes for the inbox do not check for a CSRF token. As a result, an attacker can trick a user with the &#34;access commerce administration pages&#34; permission into visiting a crafted page that will dismiss notifications for the messages. The inbox is also shared by all users, so if one commerce administrator is tricked, this hides the messages from every administrator, including notices that a security update is available.</p> <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/commerce</p> <p>This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates.</p> <p>Routes for the inbox do not check for a CSRF token. As a result, an attacker can trick a user with the &#34;access commerce administration pages&#34; permission into visiting a crafted page that will dismiss notifications for the messages. The inbox is also shared by all users, so if one commerce administrator is tricked, this hides the messages from every administrator, including notices that a security update is available.</p> https://db.gcve.eu/vuln/drupal-contrib-2026-258 https://db.gcve.eu/vuln/fkie_cve-2026-118543 <p>Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.</p> <p>Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.</p> https://db.gcve.eu/vuln/fkie_cve-2026-118543 https://db.gcve.eu/vuln/ghsa-h38c-8g33-pr7c <p>Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.</p> <p>Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.</p> https://db.gcve.eu/vuln/ghsa-h38c-8g33-pr7c https://db.gcve.eu/vuln/wid-sec-w-2026-4230 <p>Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.</p> https://db.gcve.eu/vuln/wid-sec-w-2026-4230