vendurehq vendure

• CVE-2026-63459 High 8.7 Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions 0.4%
• CVE-2026-63461 Medium 5.3 Vendure: Shop API list queries can return non-public entities when filterOperator is OR 0.4%
• CVE-2026-63472 Critical 9.1 Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification 0.6%
• CVE-2026-63460 High 7.5 Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends 0.6%
• CVE-2026-67347 Medium 6.8 Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update 0.5%
• CVE-2026-40887 Critical 9.1 @vendure/core has a SQL Injection vulnerability 1.8%
• CVE-2026-25050 Low 2.7 Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy 0.4%