CVE-2026-118539mediumexploração observadaCWE-862

CVE-2026-118539: falha de média gravidade em Drupal Commerce Core

Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Commerce Core+ Monitorar drupal/commerce

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

50Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 6.5epss 0.7%
da publicação à arma
Publicada no NVD30 de out.
VulnCheck28 de out.
Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
Drupal · Commerce Core
CVEs relacionadas — Drupal Commerce Core

No mesmo produto, das mais perigosas para as menos.

CVE-2026-10769MEDIUMCommerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041EPSS 0.2%CVE-2026-118540MEDIUMCommerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255EPSS 0.1%CVE-2026-118541MEDIUMCommerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256EPSS 0.1%CVE-2026-118542LOWCommerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257EPSS 0.1%CVE-2026-118544LOWCommerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259EPSS 0.1%CVE-2026-118543MEDIUMCommerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258EPSS 0.1%