Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.1VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCECheck if you run itEPSS 0.59%Oct 13, 2026
- Medium5.3Shopware newsletter double-opt-in bypassOpen the advisorySep 16, 2026
- Medium6.5Improper authorization in entity cloning enables privilege escalationOpen the advisorySep 16, 2026
- High8.6SQL injection in Store API aggregation handling on PHP < 8.4Open the advisorySep 16, 2026
- High8.1Privilege escalation through insufficient authorization in profile updatesOpen the advisorySep 16, 2026
- Critical9.6Webhook permission can bypass event ACLs and expose sensitive dataOpen the advisorySep 16, 2026
- Low3.7Missing Rate Limiting on DocumentRoute Guest Authentication Allows Zipcode Brute-ForceOpen the advisoryAug 25, 2026
- Medium6.3SSRF in Shopware media URL import via DNS rebinding bypass of FileUrlValidator IP validationOpen the advisoryAug 25, 2026
- High8.0Path traversal via writable media.fileExtension leads to remote code execution (single media:update privilege)Open the advisoryAug 25, 2026
- Medium5.3Unauthenticated disclosure of unapproved product reviews via nested store-api associationsOpen the advisoryAug 25, 2026
- Medium6.5GHSA-4wpv-5fvv-c3xp is listed by Privilege escalation via aclRoles mass assignment remains possible after CVE-2026-48010 fix.Open the advisoryAug 25, 2026
- High8.6Pre-authentication SQL injection in Store APIOpen the advisoryAug 25, 2026
- Critical9.1Stored SQL/DDL Injection via Custom Entity Field Names (App Manifest)Open the advisoryAug 25, 2026
- Critical9.3Admin account takeover via Host-header password-reset poisoningOpen the advisoryAug 25, 2026
- Critical9.6App Script sandbox escape allows arbitrary PHP and OS command executionOpen the advisoryAug 25, 2026
- Medium4.1SSRF in Media External-Link Endpoint Bypasses IP ValidationCheck if you run itEPSS 0.37%May 19, 2026
- Medium4.9Stored XSS via SVG file upload — no SVG sanitizationCheck if you run itEPSS 0.48%May 19, 2026
- Medium4.3Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-paymentCheck if you run itEPSS 0.41%May 19, 2026
- Medium6.5Admin API ACL Bypass in Order State Transition EndpointsCheck if you run itEPSS 0.39%May 19, 2026
- Medium4.3Shopware SSO referer trust leading to an arbitrary redirect targetCheck if you run itEPSS 0.27%May 19, 2026
- Medium6.5Privilege escalation: non-admin user with user:create ACL can create admin accountsCheck if you run itEPSS 0.47%May 19, 2026
- Medium5.3Shopware is an open commerce platform.Check if you run itEPSS 0.21%Mar 12, 2026
- Medium5.3Shopware is an open commerce platform.Check if you run itEPSS 0.21%Mar 12, 2026
- High8.9Shopware is an open commerce platform.Check if you run itEPSS 0.28%Mar 11, 2026
- Medium5.3Shopware is an open commerce platform.Check if you run itEPSS 0.23%Mar 11, 2026
Sort