CVE-2026-96378

The Drupal Commerce Decoupled Checkout module (versions 1.0.0 to 1.8.0 ) is vulnerable to Object Injection due to an Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915). The root cause is insufficient sanitization of order data passed into the module's REST en...

EUVD-2026-107822

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0...