Skip to content
Threat Feed
Subscribe

Tag

Access-Bypass

3 briefs RSS
critical threat

Drupal Commerce Core: Access Bypass Vulnerability (CVE-2026-118539)

An unauthenticated access bypass vulnerability in the Drupal Commerce Core module is being actively exploited in the wild, leading to potential financial impact on affected e-commerce platforms.

exploited Commerce Core +1 web-application-vulnerability access-bypass e-commerce active-exploitation
1t 1c updated
high threat

Critical Access Bypass Vulnerability in Drupal Internationalization Single Sign-On Module

A critical access bypass vulnerability (SA-CONTRIB-2026-081) exists in the Internationalization Single Sign-On module for Drupal, affecting versions prior to 1.8.0, allowing an attacker to bypass authentication mechanisms and potentially gain unauthorized access or elevate privileges within the application.

exploited Internationalization Single Sign-On drupal cms vulnerability access-bypass web-application
1t
high advisory

Heimdall IP Spoofing via Unvalidated Forwarding Headers

A high-severity vulnerability in dadrus/heimdall (versions <= 0.17.16) enables attackers to spoof client IP addresses by injecting unvalidated or malformed values into `Forwarded` or `X-Forwarded-For` HTTP headers, potentially bypassing access controls or propagating malicious IP data to upstream services when `trusted_proxies` is configured.

heimdall ip-spoofing access-bypass web-application github-advisory
2r 2t