Saleor vulnerabilities

Products

• Saleor 19
• React-storefront 2
• Storefront 2

Newest

• saleor Saleor throttling.py get_client_ip excessive authentication CVE-2026-93650 6.3 MediumSeptember 18, 2026
• saleor Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge CVE-2026-44472 8.1 HighAugust 18, 2026
• saleor Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check CVE-2026-48744 6.5 MediumAugust 18, 2026
• saleor requests-hardened requests-hardened: Server-Side Request Forgery (SSRF) in requests-hardened RFC 6598 CVE-2026-42175 Fix available 6.5 MediumMay 5, 2026
• saleor Saleor has a user enumeration vulnerability due to different error messages CVE-2026-39851 5.3 MediumApril 8, 2026
• saleor Saleor has Cross-Account Email Change via Unbound Confirmation Token CVE-2026-35407 5.9 MediumApril 8, 2026
• saleor Saleor has a resource exhaustion vulnerability in GraphQL queries CVE-2026-35401 7.5 HighApril 8, 2026
• saleor Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching CVE-2026-33756 7.5 HighApril 8, 2026
• saleor Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API CVE-2026-24136 Public exploit 8.7 HighJanuary 23, 2026
• saleor Saleor vulnerable to stored XSS via Unrestricted File Upload CVE-2026-23499 Public exploit 8.5 HighJanuary 21, 2026
• saleor Saleor lacks proper HTML sanitization in rich text fields CVE-2026-22849 Public exploit 7.2 HighJanuary 21, 2026
• saleor Saleor has user enumeration vulnerability due to different error messages CVE-2025-58442 5.3 MediumSeptember 9, 2025
• saleor Saleor CSRF bypass in refreshToken mutation CVE-2024-31205 4.2 MediumApril 8, 2024
• saleor Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method CVE-2024-29888 Fix available 4.2 MediumMarch 27, 2024
• saleor storefront, react-storefront +1 more Saleor Storefront session leak in cache CVE-2024-29036 4.3 MediumMarch 20, 2024
• saleor react-storefront, saleor/react-storefront +1 more Cross-site Scripting (XSS) - DOM in saleor/react-storefront CVE-2023-3294 7.6 HighJune 16, 2023
• saleor Non-constant time HMAC comparison in Adyen plugin in Saleor CVE-2023-32694 4.8 MediumMay 25, 2023
• saleor Saleor is vulnerable to unauthenticated information disclosure via Python exceptions CVE-2023-26052 Fix available 3.7 LowMarch 2, 2023
• saleor Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions CVE-2023-26051 Fix available 6.5 MediumMarch 2, 2023
• saleor Improper object type validation in saleor CVE-2022-39275 Public exploit 5.3 MediumOctober 6, 2022
• citrix storefront, storefront server +1 more Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and... CVE-2022-27503 6.1 MediumApril 13, 2022
• saleor, saleor saleor/saleor +1 more Missing Authorization in saleor/saleor CVE-2022-0932 Fix available 6.5 MediumMarch 11, 2022
• mirumee saleor Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This... CVE-2019-1010304 5.3 MediumJuly 15, 2019