https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T18:00:33.661120+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/drupal-contrib-2026-041 DRUPAL-CONTRIB-2026-041 2026-10-04T18:00:33.737625+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/commerce

The module doesn't sufficiently sanitize customer comments in the order receipt email template; this could be exploited to achieve Cross-site Scripting (XSS).

This vulnerability is mitigated by the fact that it only affects installations with Checkout (`commerce_checkout`) enabled, and the "Comments" checkout pane (id: `customer_comments`) is explicitly used, which is disabled by default.

 https://cve.radiocsirt.org/vuln/euvd-2026-336485 EUVD-2026-336485 2026-10-04T18:00:33.737686+00:00 EUVD-2026-336485 https://cve.radiocsirt.org/vuln/fkie_cve-2026-10769 fkie_cve-2026-10769 2026-10-04T18:00:33.737703+00:00

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.

 https://cve.radiocsirt.org/vuln/ghsa-rq79-xhrq-f62x GHSA-rq79-xhrq-f62x 2026-10-04T18:00:33.737727+00:00

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1799 WID-SEC-W-2026-1799 — Drupal Erweiterungen: Mehrere Schwachstellen 2026-10-04T18:00:33.737743+00:00

Ein entfernter Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um Daten zu manipulieren oder offenzulegen, sowie um Cross-Site Scripting Angriffe durchzuführen.