Ssaleor

Products

Exploited and recent CVEs

• CVE-2026-44472 High 8.1 Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge 0.6%
• CVE-2026-48744 Medium 6.5 Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check 0.4%
• CVE-2026-42175 Medium 6.5 requests-hardened: Server-Side Request Forgery (SSRF) in requests-hardened RFC 6598 0.3%
• CVE-2026-39851 Medium 5.3 Saleor has a user enumeration vulnerability due to different error messages 0.3%
• CVE-2026-35407 Medium 6.5 Saleor has Cross-Account Email Change via Unbound Confirmation Token 0.3%
• CVE-2026-35401 High 7.5 Saleor has a resource exhaustion vulnerability in GraphQL queries 0.3%
• CVE-2026-33756 High 7.5 Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching 0.5%
• CVE-2026-24136 High 8.7 Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API 0.4%
• CVE-2026-23499 High 8.5 Saleor vulnerable to stored XSS via Unrestricted File Upload 0.3%
• CVE-2026-22849 High 7.2 Saleor lacks proper HTML sanitization in rich text fields 0.2%
• CVE-2025-58442 Medium 5.3 Saleor has user enumeration vulnerability due to different error messages 0.3%
• CVE-2024-31205 Medium 4.2 Saleor CSRF bypass in refreshToken mutation 0.2%
• CVE-2024-29888 Medium 4.2 Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method 0.5%
• CVE-2024-29036 Medium 4.3 Saleor Storefront session leak in cache 0.6%
• CVE-2023-3294 High 7.6 Cross-site Scripting (XSS) - DOM in saleor/react-storefront 0.5%
• CVE-2023-32694 Medium 4.8 Non-constant time HMAC comparison in Adyen plugin in Saleor 0.3%
• CVE-2023-26052 Low 3.7 Saleor is vulnerable to unauthenticated information disclosure via Python exceptions 0.8%
• CVE-2023-26051 Medium 6.5 Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions 0.8%
• CVE-2022-39275 Medium 5.3 Improper object type validation in saleor 0.8%
• CVE-2022-0932 Medium 6.5 Missing Authorization in saleor/saleor 1.0%