TI-2026-45233 CVE-2026-63472 · GHSA-6j36-r6pr-59x4
Improper authentication in vendurehq vendure
Priority HIGH 80
Vendure is an open-source headless commerce platform.
vendurehq
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
vendurehq records in CISA KEVNo vendurehq vulnerabilities are listed in CISA KEV.
Records
6 records
TI-2026-45227 CVE-2026-63459 · GHSA-xhq9-whgq-49j5
Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
Priority HIGH 73
Vendure is an open-source headless commerce platform.
TI-2026-45228 CVE-2026-63460 · GHSA-jgm3-qmp2-c4p7
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends
Priority HIGH 72
Vendure is an open-source headless commerce platform.
TI-2026-47643 CVE-2026-67347 · GHSA-327h-gp7q-mxcj
Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update
Priority MEDIUM 60
Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to mo…
TI-2026-29543 CVE-2026-40887 · GHSA-9pp3-53p2-ww9v
@vendure/core has a SQL Injection vulnerability
Priority MEDIUM 49
Vendure is an open-source headless commerce platform.
TI-2026-45229 CVE-2026-63461 · GHSA-xf65-r35x-wmmv
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
Priority LOW 30
Vendure is an open-source headless commerce platform.