CVE-2026-118556

Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6...

PT-2026-130585

This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment. The module doesn't sufficiently protect shipment references and shipment entity fields, leading to an access bypass that can result in inappropriately modified shipment states ...