saleor vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20222
3. 20234
4. 20243
5. 20251
6. 202610

Newest CVEs

• CVE-2026-44472

  Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge

  saleor · saleor

  High8.1
• CVE-2026-48744

  Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check

  saleor · saleor

  Medium6.5
• CVE-2026-42175

  requests-hardened: Server-Side Request Forgery (SSRF) in requests-hardened RFC 6598

  saleor · requests-hardened

  Medium6.5
• CVE-2026-39851

  Saleor has a user enumeration vulnerability due to different error messages

  saleor · saleor

  Medium5.3
• CVE-2026-35407

  Saleor has Cross-Account Email Change via Unbound Confirmation Token

  saleor · saleor

  Medium5.9
• CVE-2026-35401

  Saleor has a resource exhaustion vulnerability in GraphQL queries

  saleor · saleor

  High7.5
• CVE-2026-33756

  Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching

  saleor · saleor

  High7.5
• CVE-2026-24136

  Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API

  saleor · saleor

  High8.7
• CVE-2026-23499

  Saleor vulnerable to stored XSS via Unrestricted File Upload

  saleor · saleor

  High8.5
• CVE-2026-22849

  Saleor lacks proper HTML sanitization in rich text fields

  saleor · saleor

  High7.2