Known Vulnerabilities for Commerce Core by Drupal
Listed below are 7 of the newest known vulnerabilities associated with "Commerce Core" by "Drupal".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-48016 json | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in s... | Not Provided | 2026-07-17 | 2026-07-20 |
| CVE-2026-48015 json | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in ... | Not Provided | 2026-07-17 | 2026-07-17 |
| CVE-2026-48014 json | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action/orde... | Not Provided | 2026-07-17 | 2026-07-21 |
| CVE-2026-48010 json | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Ap... | Not Provided | 2026-07-17 | 2026-07-17 |
| CVE-2026-48009 json | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:read AC... | Not Provided | 2026-07-17 | 2026-07-17 |
| CVE-2026-48008 json | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL priv... | Not Provided | 2026-07-17 | 2026-07-17 |
| CVE-2026-10769 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core al... | Not Provided | 2026-07-10 | 2026-07-14 |