Shopware

Products

Exploited and recent CVEs

• CVE-2026-104937 High 8.1 CVE-2026-104937 0.6%
• CVE-2026-48012 Medium 4.3 Shopware SSO referer trust leading to an arbitrary redirect target 0.3%
• CVE-2026-48012 Medium 4.3 Shopware SSO referer trust leading to an arbitrary redirect target 0.3%
• CVE-2026-48013 Medium 4.1 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation 0.4%
• CVE-2026-48013 Medium 4.1 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation 0.4%
• CVE-2026-48009 Medium 6.8 Shopware: Admin Account Takeover via User Recovery Hash Exposure 0.5%
• CVE-2026-48009 Medium 6.8 Shopware: Admin Account Takeover via User Recovery Hash Exposure 0.5%
• CVE-2026-48014 Medium 6.5 Shopware: Admin API ACL Bypass in Order State Transition Endpoints 0.4%
• CVE-2026-48014 Medium 6.5 Shopware: Admin API ACL Bypass in Order State Transition Endpoints 0.4%
• CVE-2026-48010 Medium 6.5 Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts 0.5%
• CVE-2026-48010 Medium 6.5 Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts 0.5%
• CVE-2026-48016 Medium 4.3 Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment 0.4%
• CVE-2026-48016 Medium 4.3 Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment 0.4%
• CVE-2026-48015 Medium 4.9 Shopware: Stored XSS via SVG file upload — no SVG sanitization 0.5%
• CVE-2026-48015 Medium 4.9 Shopware: Stored XSS via SVG file upload — no SVG sanitization 0.5%
• CVE-2026-48008 Medium 6.5 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass 0.5%
• CVE-2026-48008 Medium 6.5 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass 0.5%
• CVE-2026-48011 Low 3.7 Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames 0.2%
• CVE-2026-32142 Medium 5.3 shopware/commercial: `/api/_info/config` route exposes information about licenses 0.2%
• CVE-2026-31889 High 8.9 Shopware has a potential take over of app credentials 0.3%
• CVE-2026-31889 High 8.9 Shopware has a potential take over of app credentials 0.3%
• CVE-2026-31888 Medium 5.3 Shopware has user enumeration via distinct error codes on Store API login endpoint 0.3%
• CVE-2026-31888 Medium 5.3 Shopware has user enumeration via distinct error codes on Store API login endpoint 0.3%
• CVE-2026-31887 High 8.9 Shopware unauthenticated data extraction possible through store-api.order endpoint 0.3%
• CVE-2026-31887 High 8.9 Shopware unauthenticated data extraction possible through store-api.order endpoint 0.3%
• CVE-2026-23498 High 7.2 Shopware Improper Control of Generation of Code in Twig rendered views 0.4%
• CVE-2025-67648 High 7.1 Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page 0.2%
• CVE-2025-7954 Medium 6.0 Race Condition in Shopware Voucher Submission 0.4%
• CVE-2025-32378 Medium 6.9 Shopware's default newsletter opt-in settings allow for mass sign-up abuse 0.3%
• CVE-2025-30150 Medium 5.5 Shopware 6 allows attackers to check for registered accounts through the store-api 0.4%