EUVD-2026-66206

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions:...

PT-2026-82363

Name of the Vulnerable Software and Affected Versions Drupal Commerce CyberSource versions 0.0.0 through 1.10.0 Description An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the...

CVE-2026-19485: Use of Insufficiently Random Values

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...

Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...

CVE-2026-16641

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions:...

CVE-2026-16641 Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions:...

CVE-2026-16641 Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions:...

CVE-2026-16641

A security issue exists in Drupal Commerce Elavon (affected versions . ). The project has been marked as unsupported by the security team because a known security flaw remains unaddressed by the maintainer. While Rapid7 identifies the issue as Improper Input Validation , there is currently no inf...

Adobe Commerce & Magento - CosmicSting

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary code execution. id: CVE-2024-34102 info: name: Adobe Commerce & Magento - CosmicSting author:...

CVE-2026-16641: Improper Input Validation

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions:...

Exploit for CVE-2026-58231

CVE-2026-58231 Detection Script Detection and precondition-ve...

CVE-2025-15671

The Welcart e-Commerce WordPress plugin, in versions before 2.12.1 , is vulnerable to a session fixation attack. The flaw exists because the plugin fails to regenerate the session identifier upon authentication and allows the session identifier to be set from a user-supplied request parameter (sp...

CVE-2025-15671 Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...

CVE-2025-15671 Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...

CVE-2025-15671: Improper Authentication

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...

CVE-2026-74013

Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...

CVE-2026-74013

eShipper Commerce WordPress plugin (versions

CVE-2026-74013 WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability

Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...

WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability

SQL Injection vulnerability discovered by hivesec in WordPress Plugin eShipper Commerce versions = 2.16.13...

PT-2026-78988

Name of the Vulnerable Software and Affected Versions eShipper Commerce versions prior to 2.16.14 Description An SQL Injection issue exists in the subscriber component, allowing an attacker to interfere with the queries that an application makes to its database. Recommendations Update to a versio...