Skip to content
Shopify vulnerabilities
Newest
-
shopify app
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
CVE-2026-63414
Fix available
7.6 High
-
shopify tophat, toptech systems tms7 +1 more
Toptech TMS7 and TopHAT Cross-site Scripting
CVE-2026-71189
4.8 Medium
-
shopify tophat, toptech systems tms7 +1 more
Toptech TMS7 and TopHAT Eval Injection
CVE-2026-69662
2.1 Low
-
shopify tophat, toptech systems tms7 +1 more
Toptech TMS7 and TopHAT Session Fixation
CVE-2026-71302
7.5 High
-
shopify tophat, toptech systems tms7 +1 more
Toptech TMS7 and TopHAT SQL Injection
CVE-2026-72507
8.5 High
-
shopify tophat, toptech systems tms7 +1 more
Toptech TMS7 and TopHAT SQL Injection
CVE-2026-68068
8.5 High
-
shopify tophat, toptech systems tms7 +1 more
Toptech TMS7 and TopHAT SQL Injection
CVE-2026-68954
8.5 High
-
shopify tophat, toptech systems tms7 +1 more
Toptech TMS7 and TopHAT SQL Injection
CVE-2026-63713
8.5 High
-
shopify tophat, toptech systems tms7 +1 more
Toptech TMS7 and TopHAT SQL Injection
CVE-2026-72510
8.5 High
-
shopify tophat, toptech systems tms7 +1 more
Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type
CVE-2026-70356
9.4 Critical
-
shopify tophat, toptech systems tms7 +1 more
Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties
CVE-2026-71379
10.0 Critical
-
shopify ruby-lsp
Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension
CVE-2026-48122
5.4 Medium
-
@tanstack react-router
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
CVE-2026-55685
Fix available
8.7 High
-
@tanstack react-router
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
CVE-2026-53669
Fix available
5.1 Medium
-
@tanstack react-router
React Router: Open redirect can lead to XSS
CVE-2026-53668
Fix available
6.9 Medium
-
@tanstack react-router
React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)
CVE-2026-53667
Fix available
6.9 Medium
-
@tanstack react-router
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
CVE-2026-53666
Fix available
6.1 Medium
-
@tanstack react-router, remix-run @remix-run/server-runtime, shopify remix-run\/server-runtime +2 more
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
CVE-2026-42342
Fix available
7.5 High
-
@tanstack react-router
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
CVE-2026-42211
Fix available
8.1 High
-
@tanstack react-router, remix-run @remix-run/router +1 more
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
CVE-2026-40181
Fix available
6.6 Medium
-
@tanstack react-router, remix-run turbo-stream, turbo-stream turbo stream +2 more
React Router vulnerable to Denial of Service via reflected user input in single-fetch
CVE-2026-34077
Fix available
7.5 High
-
@tanstack react-router
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
CVE-2026-33245
Fix available
8.0 High
-
@tanstack react-router
React Router has stored XSS via unescaped Location header in prerendered redirect HTML
CVE-2026-33244
Fix available
5.4 Medium
-
shopify tophat
Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link
CVE-2026-39862
6.3 Medium
-
shopify ruby-lsp, ruby lsp, shopify.ruby-lsp +2 more
Ruby LSP has arbitrary code execution through branch setting
CVE-2026-34060
Fix available
7.1 High
-
@tanstack react-router, shopify remix-run\/react +1 more
React Router has CSRF issue in Action/Server Action Request Processing
CVE-2026-22030
Fix available
6.5 Medium
-
@tanstack react-router, remix-run @remix-run/router, red hat cryostat 4 +74 more +76 more
React Router vulnerable to XSS via Open Redirects
CVE-2026-22029
Fix available
8.0 High
-
@tanstack react-router, red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +6 more +8 more
React Router SSR XSS in ScrollRestoration
CVE-2026-21884
Fix available
8.2 High
-
@tanstack react-router
React Router has unexpected external redirect via untrusted paths
CVE-2025-68470
Fix available
6.5 Medium
-
@tanstack react-router, red hat cryostat 4, gatekeeper 3 +47 more +49 more
React Router has Path Traversal in File Session Storage
CVE-2025-61686
Public exploitFix available
EPSS 17.3%
9.1 Critical
-
@tanstack react-router, red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +6 more +8 more
React Router has XSS Vulnerability
CVE-2025-59057
Public exploitFix available
7.6 High
-
shopify job-iteration
Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class
CVE-2025-53623
Fix available
8.1 High
-
shopify ejson2env
ejson2env has insufficient input sanitization
CVE-2025-48069
Fix available
6.6 Medium
-
shopify pitchfork
Pitchfork HTTP Request/Response Splitting vulnerability
CVE-2025-30221
Fix available
4.3 Medium
-
shopify tophat
Improper Access Control Vulnerability When Accessing a Maliciously Crafted Tophat Link
CVE-2024-45036
4.3 Medium
-
shopify hydrogen
Potential cross-site scripting (XSS) vulnerability in Hydrogen
CVE-2022-29230
Fix available
6.3 Medium
-
shopify koa-shopify-auth
Cross-site scripting in @shopify/koa-shopify-auth
CVE-2020-8176
Fix available
6.1 Medium