Vulnerabilities

TI-2026-32411 CVE-2026-44472

Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge

LOW 38

Saleor is an e-commerce platform.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.0063 Published 2026-08-18 Fixed in 3.21.67, 3.22.63 +1 CWE-287

TI-2026-36015 CVE-2026-48744

Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check

LOW 35

Saleor is an e-commerce platform.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00379 Published 2026-08-18 Fixed in 3.21.67, 3.22.63 +1 CWE-285

TI-2026-30500 CVE-2026-42175 · GHSA-vh75-fwv3-pqrh

requests-hardened: Server-Side Request Forgery (SSRF) in requests-hardened RFC 6598

LOW 29

requests-hardened is a library that overrides the default behaviors of the requests library, and adds new security features.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00305 Published 2026-05-12 Fixed in 1.2.1 CWE-918

TI-2026-28733 CVE-2026-39851

Saleor has a user enumeration vulnerability due to different error messages

LOW 24

Saleor is an e-commerce platform.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00252 Published 2026-04-08 Fixed in 3.20.118, 3.21.54 +2 CWE-204

TI-2026-27543 CVE-2026-35407

Saleor has Cross-Account Email Change via Unbound Confirmation Token

LOW 26

Saleor is an e-commerce platform.

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00299 Published 2026-04-08 Fixed in 3.20.118, 3.21.54 +2 CWE-285

TI-2026-27537 CVE-2026-35401

Saleor has a resource exhaustion vulnerability in GraphQL queries

LOW 39

Saleor is an e-commerce platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00273 Published 2026-04-08 Fixed in 3.20.118, 3.21.54 +2 CWE-770

TI-2026-26135 CVE-2026-33756

Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching

LOW 39

Saleor is an e-commerce platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00452 Published 2026-04-08 Fixed in 3.20.118, 3.21.54 +2 CWE-770

TI-2026-19454 CVE-2026-24136

Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API

MEDIUM 44

Saleor is an e-commerce platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00404 Published 2026-01-23 Fixed in 3.22.29, 3.21.45 +1 CWE-639

TI-2026-18932 CVE-2026-23499

Saleor vulnerable to stored XSS via Unrestricted File Upload

LOW 37

Saleor is an e-commerce platform.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00272 Published 2026-01-21 Fixed in 3.22.27, 3.21.43 +1 CWE-434

TI-2026-18341 CVE-2026-22849

Saleor lacks proper HTML sanitization in rich text fields

LOW 31

Saleor is an e-commerce platform.

CVSS 4.0HIGH 7.2 Network High privileges User interaction EPSS 0.00245 Published 2026-01-21 Fixed in 3.22.27, 3.21.43 +1 CWE-83

TI-2025-36200 CVE-2025-58442

Saleor has user enumeration vulnerability due to different error messages

LOW 30

Saleor is an e-commerce platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00311 Published 2025-09-09 Fixed in 3.21.16 CWE-204

TI-2024-20582 CVE-2024-31205

Saleor CSRF bypass in refreshToken mutation

LOW 24

Saleor is an e-commerce platform.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00193 Published 2024-04-08 Fixed in 3.14.64, 3.15.39 +4 CWE-352

TI-2024-19656 CVE-2024-29888 · GHSA-mrj3-f2h4-7w45

Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method

LOW 25

Saleor is an e-commerce platform that serves high-volume companies.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00534 Published 2024-03-27 Fixed in 3.14.61, 3.15.37 +4 CWE-359

TI-2024-19218 CVE-2024-29036

Saleor Storefront session leak in cache

LOW 30

Saleor Storefront is software for building e-commerce experiences.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0057 Published 2024-03-20 Fixed in 579241e CWE-200

TI-2023-03083 CVE-2023-3294 · GHSA-pqx3-wcmm-q9p2

Cross-site Scripting (XSS) - DOM in saleor/react-storefront

LOW 28

Cross-site Scripting (XSS) - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00459 Published 2023-06-16 Fixed in c29aab2 CWE-79

TI-2023-15970 CVE-2023-32694

Non-constant time HMAC comparison in Adyen plugin in Saleor

LOW 24

Saleor Core is a composable, headless commerce API.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00341 Published 2023-05-25 Fixed in 3.7.68, 3.8.40 +5 CWE-203

TI-2023-11285 CVE-2023-26052 · GHSA-3hvj-3cg9-v242

Saleor is vulnerable to unauthenticated information disclosure via Python exceptions

LOW 25

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00757 Published 2023-03-02 Fixed in 3.1.48, 3.11.12 +4 CWE-209

TI-2023-11284 CVE-2023-26051 · GHSA-r8qr-wwg3-2r85

Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions

LOW 30

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00824 Published 2023-03-02 Fixed in 3.1.48, 3.11.12 +4 CWE-209

TI-2022-18651 CVE-2022-39275

Improper object type validation in saleor

LOW 31

Saleor is a headless, GraphQL commerce platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00779 Published 2022-10-06 Fixed in 3.1.24, 3.2.14 +5 CWE-863

TI-2022-00832 CVE-2022-0932 · GHSA-mcgw-5fhw-3fq8

Missing Authorization in saleor/saleor

LOW 31

Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01018 Published 2022-03-11 Fixed in 3.1.2 CWE-862

TI-2019-16068 CVE-2019-1010304 · GHSA-9r7g-8c57-3gxp

Missing authorization in Saleor

LOW 26

Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01171 Published 2019-07-15 No fix listed CWE-862

Vulnerabilities

Filters