CVE-2026-118557

Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6...

CVE-2026-118556

Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6...

CVE-2026-118556

The Drupal Commerce Shipping module is affected by an incorrect authorization vulnerability (CWE-863) in versions 0.0.0 to 2.16.0 and 3.0.0 to 3.0.6 . The module fails to sufficiently protect shipment references and shipment entity fields, leading to an access bypass that may allow an attacker to...

EUVD-2026-113511

Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6...

CVE-2026-118557

The Drupal Commerce Shipping module is vulnerable to an Incorrect Authorization issue, specifically allowing Forceful Browsing . The root cause is that the module fails to sufficiently check access permissions on the form used to resend receipts. Depending on the configuration, this allows unauth...

EUVD-2026-113510

Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6...

CVE-2026-25486 Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation

Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the Store Management section is n...