Vendors / Vendure Records 2 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 0
Exploited now Vendure records in CISA KEV No Vendure vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority LOW 25
In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00615 · Published 2022-05-02 · No fix listed CWE-79
Priority LOW 20
Vendure is an open-source headless commerce platform.
CVSS 4.0 LOW 2.7· Network · No auth · No interaction · EPSS 0.004 · Published 2026-01-30 · Fixed in 3.5.3 CWE-202
Open these records in search → All records by CVSS severity
0 0 1 1 0
