EUVD-2026-113495
GHSA-p9vx-7cwj-4hhm
View
Awaiting Data
No severity or threat signals available yet. Label will update when CVSS score is published or threat intelligence arrives. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).
No patch listed yet
0.1% exploitation probability (EPSS)
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisCVE.org
Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.
Affected VersionsENISA
PayUmoney for Drupal Commerce *.*
Affected Packages
composer
drupal/commerce_payumoney
no fix
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Payumoney For Drupal Commerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Threat Intelligence Overview
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
SignalValue
Severity
Not scored yet
CISA KEV
No
Public POC
No
EPSS
0.1%
Patch available
No
Active threat
No
Deciding rule
No CVSS yet + weak signal (CWE or non-zero EPSS)
What every action level means
Emergency
Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now
Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week
Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month
Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor
Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.
Exploit-DB