Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    DRUPAL-CONTRIB-2026-179 (CVE-2026-96378)

    Vulnerability from drupal – Published: 2026-09-23 17:06 – Updated: 2026-09-23 17:06 – Source website
    VLAI
    Details

    This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation.

    The module doesn't sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order.

    Credits
    Marcus Johansson (marcus_johansson) www.drupal.org/u/marcus_johansson
    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003e=1.0.0 \u003c1.8.0"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/commerce_decoupled_checkout"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003e=1.0.0 \u003c1.8.0"
          },
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-96378"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/marcus_johansson"
      ],
      "name": "Marcus Johansson (marcus_johansson)"
    }
  ],
  "details": "This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation.\n\nThe module doesn\u0027t sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order.",
  "id": "DRUPAL-CONTRIB-2026-179",
  "modified": "2026-09-23T17:06:19.000Z",
  "published": "2026-09-23T17:06:19.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-179"
    }
  ],
  "schema_version": "1.7.0"
}