Composer drupal/commerce has 10 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-10769 | The module doesn't sufficiently sanitize customer comments in the order receipt email template; this could be exploited | unknown | 0.0 | >= 3.3.0 < 3.3.6 | 3.3.6 |
| CVE-2026-118539 | This module enables you to sell goods and services to customers through an included shopping cart and checkout form or t | unknown | 0.0 | <2.41 or >=3.0.0 <3.3.13 | 2.41.0, 3.3.13 |
| CVE-2026-118540 | This module enables you to sell goods and services to customers through a shopping cart and checkout form. When Drupal | unknown | 0.0 | <2.41 or >=3.0.0 <3.2.0 | 2.41.0, 3.2.0 |
| CVE-2026-118541 | This module enables you to sell goods and services to customers through a shopping cart and checkout form. It includes a | unknown | 0.0 | <2.41.0 or >=3.0.0 <3.3.13 | 2.41.0, 3.3.13 |
| CVE-2026-118542 | This module enables you to sell goods and services to customers through a shopping cart and checkout form. Sites can als | unknown | 0.0 | <2.41.0 or >=3.0.0 <3.3.13 | 2.41.0, 3.3.13 |
| CVE-2026-118543 | This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an i | unknown | 0.0 | <2.41.0 or >=3.0.0 <3.3.13 | 2.41.0, 3.3.13 |
| CVE-2026-118544 | This module enables you to sell goods and services to customers through a shopping cart and checkout form. The module d | unknown | 0.0 | <2.41.0 or >=3.0.0 <3.3.13 | 2.41.0, 3.3.13 |
| DRUPAL-CONTRIB-2018-057 | This module enables you to build eCommerce websites and applications with Drupal. The module doesn't sufficiently check | unknown | 0.0 | <2.9.0 | 2.9.0 |
| DRUPAL-CONTRIB-2020-020 | Drupal Commerce is used to build eCommerce websites and applications. It's possible to configure commerce to permit orde | unknown | 0.0 | <2.18.0 | 2.18.0 |
| DRUPAL-CONTRIB-2021-032 | This module provides a system for building an ecommerce solution in their Drupal site. The module doesn't sufficiently | unknown | 0.0 | <2.27.0 | 2.27.0 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked