Priority MEDIUM 44
Saleor is an e-commerce platform.
saleor
Records21All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
saleor records in CISA KEVNo saleor vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
21 records
Priority LOW 39
Saleor is an e-commerce platform.
TI-2026-26135 CVE-2026-33756
Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching
Priority LOW 39
Saleor is an e-commerce platform.
TI-2026-32411 CVE-2026-44472
Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge
Priority LOW 38
Saleor is an e-commerce platform.
Priority LOW 37
Saleor is an e-commerce platform.
TI-2026-36015 CVE-2026-48744
Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check
Priority LOW 35
Saleor is an e-commerce platform.
Priority LOW 31
Saleor is an e-commerce platform.
TI-2022-18651 CVE-2022-39275
Improper object type validation in saleor
Priority LOW 31
Saleor is a headless, GraphQL commerce platform.
TI-2022-00832 CVE-2022-0932 · GHSA-mcgw-5fhw-3fq8
Missing Authorization in saleor/saleor
Priority LOW 31
Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.
TI-2025-36200 CVE-2025-58442
Saleor has user enumeration vulnerability due to different error messages
Priority LOW 30
Saleor is an e-commerce platform.
TI-2024-19218 CVE-2024-29036
Saleor Storefront session leak in cache
Priority LOW 30
Saleor Storefront is software for building e-commerce experiences.
TI-2023-11284 CVE-2023-26051 · GHSA-r8qr-wwg3-2r85
Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions
Priority LOW 30
Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences.
TI-2026-30500 CVE-2026-42175 · GHSA-vh75-fwv3-pqrh
requests-hardened: Server-Side Request Forgery (SSRF) in requests-hardened RFC 6598
Priority LOW 29
requests-hardened is a library that overrides the default behaviors of the requests library, and adds new security features.
TI-2023-03083 CVE-2023-3294 · GHSA-pqx3-wcmm-q9p2
Cross-site Scripting (XSS) - DOM in saleor/react-storefront
Priority LOW 28
Cross-site Scripting (XSS) - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7.
Priority LOW 26
Saleor is an e-commerce platform.
TI-2019-16068 CVE-2019-1010304 · GHSA-9r7g-8c57-3gxp
Missing authorization in Saleor
Priority LOW 26
Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c.
TI-2024-19656 CVE-2024-29888 · GHSA-mrj3-f2h4-7w45
Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method
Priority LOW 25
Saleor is an e-commerce platform that serves high-volume companies.
TI-2023-11285 CVE-2023-26052 · GHSA-3hvj-3cg9-v242
Saleor is vulnerable to unauthenticated information disclosure via Python exceptions
Priority LOW 25
Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences.
TI-2026-28733 CVE-2026-39851
Saleor has a user enumeration vulnerability due to different error messages
Priority LOW 24
Saleor is an e-commerce platform.
TI-2024-20582 CVE-2024-31205
Saleor CSRF bypass in refreshToken mutation
Priority LOW 24
Saleor is an e-commerce platform.
Priority LOW 24
Saleor Core is a composable, headless commerce API.