Vendor hub

Drupal vulnerabilities

Dossiers

CVE-2026-118539CRITICAL

Unauthenticated access bypass in Drupal Commerce Core (SA-CONTRIB-2026-254) exploited for fraudulent orders; fixed in 3.3.13 and 8.x-2.41.

Updated 2026-11-09

CVE	Product	Added to KEV	Status	Dossier
CVE-2026-9082	Drupal Core	2026-05-22	Active exploitation	Planned
CVE-2018-7602	Drupal Core	2022-04-13	Active exploitation	Planned
CVE-2019-6340	Drupal Core	2022-03-25	Active exploitation	Planned
CVE-2020-13671	Drupal core	2022-01-18	Active exploitation	Planned
CVE-2018-7600	Drupal Core	2021-11-03	Active exploitation	Planned