TI-2026-45227 CVE-2026-63459 · GHSA-xhq9-whgq-49j5
Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
Priority HIGH 73
Vendure is an open-source headless commerce platform.
Vulnerabilities
6 records
TI-2026-45229 CVE-2026-63461 · GHSA-xf65-r35x-wmmv
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
Priority LOW 30
Vendure is an open-source headless commerce platform.
TI-2026-45233 CVE-2026-63472 · GHSA-6j36-r6pr-59x4
Improper authentication in vendurehq vendure
Priority HIGH 80
Vendure is an open-source headless commerce platform.
TI-2026-45228 CVE-2026-63460 · GHSA-jgm3-qmp2-c4p7
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends
Priority HIGH 72
Vendure is an open-source headless commerce platform.
TI-2026-47643 CVE-2026-67347 · GHSA-327h-gp7q-mxcj
Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update
Priority MEDIUM 60
Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to mo…
TI-2026-29543 CVE-2026-40887 · GHSA-9pp3-53p2-ww9v
@vendure/core has a SQL Injection vulnerability
Priority MEDIUM 49
Vendure is an open-source headless commerce platform.