Log in Start free

Shopify

Products

ProductCVEsExploitedLatest
tophat2–Apr 8, 2026
ruby-lsp2–Aug 7, 2026
job-iteration1–Jul 14, 2025
pitchfork1–Mar 27, 2025
ejson2env1–May 21, 2025
shopify_app1–Oct 30, 2026
Shopify.ruby-lsp1–Mar 31, 2026
hydrogen1–May 18, 2022

Exploited and recent CVEs

  • CVE-2026-63414 High 7.6 Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps 0.7%
  • CVE-2026-48122 Medium 5.4 Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension 0.2%
  • CVE-2026-39862 Medium 6.3 Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link 0.6%
  • CVE-2026-34060 Critical 9.8 Ruby LSP has arbitrary code execution through branch setting 0.5%
  • CVE-2026-34060 Critical 9.8 Ruby LSP has arbitrary code execution through branch setting 0.5%
  • CVE-2025-53623 High 8.1 Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class 0.8%
  • CVE-2025-48069 Medium 6.6 ejson2env has insufficient input sanitization 1.4%
  • CVE-2025-30221 Medium 4.3 Pitchfork HTTP Request/Response Splitting vulnerability 0.3%
  • CVE-2024-45036 Medium 4.3 Improper Access Control Vulnerability When Accessing a Maliciously Crafted Tophat Link 0.3%
  • CVE-2022-29230 Medium 6.3 Potential cross-site scripting (XSS) vulnerability in Hydrogen 0.8%