Vulnerabilities

TI-2026-28733 CVE-2026-39851

Saleor has a user enumeration vulnerability due to different error messages

LOW 24

Saleor is an e-commerce platform.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00252 Published 2026-04-08 Fixed in 3.20.118, 3.21.54 +2 CWE-204

TI-2026-27543 CVE-2026-35407

Saleor has Cross-Account Email Change via Unbound Confirmation Token

LOW 26

Saleor is an e-commerce platform.

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00299 Published 2026-04-08 Fixed in 3.20.118, 3.21.54 +2 CWE-285

TI-2026-27537 CVE-2026-35401

Saleor has a resource exhaustion vulnerability in GraphQL queries

LOW 39

Saleor is an e-commerce platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00273 Published 2026-04-08 Fixed in 3.20.118, 3.21.54 +2 CWE-770

TI-2026-26135 CVE-2026-33756

Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching

LOW 39

Saleor is an e-commerce platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00452 Published 2026-04-08 Fixed in 3.20.118, 3.21.54 +2 CWE-770

TI-2026-19454 CVE-2026-24136

Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API

MEDIUM 44

Saleor is an e-commerce platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00404 Published 2026-01-23 Fixed in 3.22.29, 3.21.45 +1 CWE-639

TI-2026-18932 CVE-2026-23499

Saleor vulnerable to stored XSS via Unrestricted File Upload

LOW 37

Saleor is an e-commerce platform.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00272 Published 2026-01-21 Fixed in 3.22.27, 3.21.43 +1 CWE-434

TI-2026-18341 CVE-2026-22849

Saleor lacks proper HTML sanitization in rich text fields

LOW 31

Saleor is an e-commerce platform.

CVSS 4.0HIGH 7.2 Network High privileges User interaction EPSS 0.00245 Published 2026-01-21 Fixed in 3.22.27, 3.21.43 +1 CWE-83

TI-2024-20582 CVE-2024-31205

Saleor CSRF bypass in refreshToken mutation

LOW 24

Saleor is an e-commerce platform.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00193 Published 2024-04-08 Fixed in 3.14.64, 3.15.39 +4 CWE-352

TI-2024-19656 CVE-2024-29888 · GHSA-mrj3-f2h4-7w45

Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method

LOW 25

Saleor is an e-commerce platform that serves high-volume companies.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00534 Published 2024-03-27 Fixed in 3.14.61, 3.15.37 +4 CWE-359

TI-2023-15970 CVE-2023-32694

Non-constant time HMAC comparison in Adyen plugin in Saleor

LOW 24

Saleor Core is a composable, headless commerce API.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00341 Published 2023-05-25 Fixed in 3.7.68, 3.8.40 +5 CWE-203

TI-2023-11285 CVE-2023-26052 · GHSA-3hvj-3cg9-v242

Saleor is vulnerable to unauthenticated information disclosure via Python exceptions

LOW 25

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00757 Published 2023-03-02 Fixed in 3.1.48, 3.11.12 +4 CWE-209

TI-2023-11284 CVE-2023-26051 · GHSA-r8qr-wwg3-2r85

Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions

LOW 30

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00824 Published 2023-03-02 Fixed in 3.1.48, 3.11.12 +4 CWE-209

TI-2022-18651 CVE-2022-39275

Improper object type validation in saleor

LOW 31

Saleor is a headless, GraphQL commerce platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00779 Published 2022-10-06 Fixed in 3.1.24, 3.2.14 +5 CWE-863

TI-2022-00832 CVE-2022-0932 · GHSA-mcgw-5fhw-3fq8

Missing Authorization in saleor/saleor

LOW 31

Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01018 Published 2022-03-11 Fixed in 3.1.2 CWE-862

Vulnerabilities

Filters