Skip to contentSaleor Saleor vulnerabilities
- saleorSaleor throttling.py get_client_ip excessive authenticationCVE-2026-936506.3 Medium
- saleorSaleor: Account pre-hijacking vulnerability due to unverified anonymous order mergeCVE-2026-444728.1 High
- saleorSaleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission checkCVE-2026-487446.5 Medium
- saleorSaleor has a user enumeration vulnerability due to different error messagesCVE-2026-398515.3 Medium
- saleorSaleor has Cross-Account Email Change via Unbound Confirmation TokenCVE-2026-354075.9 Medium
- saleorSaleor has a resource exhaustion vulnerability in GraphQL queriesCVE-2026-354017.5 High
- saleorSaleor Affected by Denial of Service via Unbounded GraphQL Query BatchingCVE-2026-337567.5 High
- saleorSaleor has an Insecure Direct Object Reference (IDOR) in GraphQL APICVE-2026-24136Public exploit8.7 High
- saleorSaleor vulnerable to stored XSS via Unrestricted File UploadCVE-2026-23499Public exploit8.5 High
- saleorSaleor lacks proper HTML sanitization in rich text fieldsCVE-2026-22849Public exploit7.2 High
- saleorSaleor has user enumeration vulnerability due to different error messagesCVE-2025-584425.3 Medium
- saleorSaleor CSRF bypass in refreshToken mutationCVE-2024-312054.2 Medium
- saleorSaleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery methodCVE-2024-29888Fix available4.2 Medium
- saleor react-storefront, saleor/react-storefront +1 moreCross-site Scripting (XSS) - DOM in saleor/react-storefrontCVE-2023-32947.6 High
- saleorNon-constant time HMAC comparison in Adyen plugin in SaleorCVE-2023-326944.8 Medium
- saleorSaleor is vulnerable to unauthenticated information disclosure via Python exceptionsCVE-2023-26052Fix available3.7 Low
- saleorSaleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptionsCVE-2023-26051Fix available6.5 Medium
- saleorImproper object type validation in saleorCVE-2022-39275Public exploit5.3 Medium
- saleor, saleor saleor/saleor +1 moreMissing Authorization in saleor/saleorCVE-2022-0932Fix available6.5 Medium
- mirumee saleorSaleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This...CVE-2019-10103045.3 Medium