Shopware security vulnerabilities
CMS / eCommerce / ERP. Public CVE monitoring for Shopware. Vendor security advisories are linked on this page.
Built for Operators of this product.
33 public records · 0 security-fix timeline events. 0 published in the last 7 days. 27 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 4
- High 5
- Medium 5
- Low 1
2026-08-0615 issues2026-11-03
Known exploited
View all known exploitedNo records match this view.
Recently published
Browse catalog- High8.1VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCECheck if you run itEPSS 0.59%Oct 13, 2026
- Medium5.3Shopware newsletter double-opt-in bypassOpen the advisorySep 16, 2026
- Medium6.5Improper authorization in entity cloning enables privilege escalationOpen the advisorySep 16, 2026
- High8.6SQL injection in Store API aggregation handling on PHP < 8.4Open the advisorySep 16, 2026
- High8.1Privilege escalation through insufficient authorization in profile updatesOpen the advisorySep 16, 2026
- Critical9.6Webhook permission can bypass event ACLs and expose sensitive dataOpen the advisorySep 16, 2026
- Medium6.3SSRF in Shopware media URL import via DNS rebinding bypass of FileUrlValidator IP validationOpen the advisoryAug 25, 2026
- High8.0Path traversal via writable media.fileExtension leads to remote code execution (single media:update privilege)Open the advisoryAug 25, 2026
- Medium5.3Unauthenticated disclosure of unapproved product reviews via nested store-api associationsOpen the advisoryAug 25, 2026
- High8.6Pre-authentication SQL injection in Store APIOpen the advisoryAug 25, 2026