saleor

Records21All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

saleor records in CISA KEV

No saleor vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Saleor 14 records MEDIUM React-storefront 2 records LOW

Records

14 records in Saleor · all components

TI-2026-19454 CVE-2026-24136

Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API

MEDIUM 44

Saleor is an e-commerce platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00404 Published 2026-01-23 Fixed in 3.22.29, 3.21.45 +1 CWE-639

TI-2026-27537 CVE-2026-35401

Saleor has a resource exhaustion vulnerability in GraphQL queries

LOW 39

Saleor is an e-commerce platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00273 Published 2026-04-08 Fixed in 3.20.118, 3.21.54 +2 CWE-770

TI-2026-26135 CVE-2026-33756

Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching

LOW 39

Saleor is an e-commerce platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00452 Published 2026-04-08 Fixed in 3.20.118, 3.21.54 +2 CWE-770

TI-2026-18932 CVE-2026-23499

Saleor vulnerable to stored XSS via Unrestricted File Upload

LOW 37

Saleor is an e-commerce platform.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00272 Published 2026-01-21 Fixed in 3.22.27, 3.21.43 +1 CWE-434

TI-2026-18341 CVE-2026-22849

Saleor lacks proper HTML sanitization in rich text fields

LOW 31

Saleor is an e-commerce platform.

CVSS 4.0HIGH 7.2 Network High privileges User interaction EPSS 0.00245 Published 2026-01-21 Fixed in 3.22.27, 3.21.43 +1 CWE-83

TI-2022-18651 CVE-2022-39275

Improper object type validation in saleor

LOW 31

Saleor is a headless, GraphQL commerce platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00779 Published 2022-10-06 Fixed in 3.1.24, 3.2.14 +5 CWE-863

TI-2022-00832 CVE-2022-0932 · GHSA-mcgw-5fhw-3fq8

Missing Authorization in saleor/saleor

LOW 31

Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01018 Published 2022-03-11 Fixed in 3.1.2 CWE-862

TI-2023-11284 CVE-2023-26051 · GHSA-r8qr-wwg3-2r85

Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions

LOW 30

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00824 Published 2023-03-02 Fixed in 3.1.48, 3.11.12 +4 CWE-209

TI-2026-27543 CVE-2026-35407

Saleor has Cross-Account Email Change via Unbound Confirmation Token

LOW 26

Saleor is an e-commerce platform.

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00299 Published 2026-04-08 Fixed in 3.20.118, 3.21.54 +2 CWE-285

TI-2024-19656 CVE-2024-29888 · GHSA-mrj3-f2h4-7w45

Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method

LOW 25

Saleor is an e-commerce platform that serves high-volume companies.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00534 Published 2024-03-27 Fixed in 3.14.61, 3.15.37 +4 CWE-359

TI-2023-11285 CVE-2023-26052 · GHSA-3hvj-3cg9-v242

Saleor is vulnerable to unauthenticated information disclosure via Python exceptions

LOW 25

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00757 Published 2023-03-02 Fixed in 3.1.48, 3.11.12 +4 CWE-209

TI-2026-28733 CVE-2026-39851

Saleor has a user enumeration vulnerability due to different error messages

LOW 24

Saleor is an e-commerce platform.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00252 Published 2026-04-08 Fixed in 3.20.118, 3.21.54 +2 CWE-204

TI-2024-20582 CVE-2024-31205

Saleor CSRF bypass in refreshToken mutation

LOW 24

Saleor is an e-commerce platform.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00193 Published 2024-04-08 Fixed in 3.14.64, 3.15.39 +4 CWE-352

TI-2023-15970 CVE-2023-32694

Non-constant time HMAC comparison in Adyen plugin in Saleor

LOW 24

Saleor Core is a composable, headless commerce API.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00341 Published 2023-05-25 Fixed in 3.7.68, 3.8.40 +5 CWE-203

Open these records in search →