Log in Start free

spree

Products

ProductCVEsExploitedLatest
spree7–Sep 22, 2026
spree_auth_devise1–Nov 17, 2021

Exploited and recent CVEs

  • CVE-2026-94462 High 7.1 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR) 0.4%
  • CVE-2026-25757 High 7.7 Unauthenticated Spree Commerce users can view completed guest orders by Order ID 0.5%
  • CVE-2026-25758 High 7.7 Spree allows unauthenticated users can access all guest addresses 0.7%
  • CVE-2026-22589 High 7.5 Spree API has Unauthenticated IDOR - Guest Address 0.4%
  • CVE-2026-22588 Medium 6.5 Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification 0.4%
  • CVE-2021-41275 Critical 9.3 Authentication Bypass by CSRF Weakness 0.6%
  • CVE-2020-26223 High 7.7 Authorization bypass in Spree 1.1%
  • CVE-2020-15269 High 7.4 Expired token reuse in Spree 1.1%