Sylius vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20205
3. 20213
4. 20225
5. 20242
6. 20252
7. 202617

Newest CVEs

• CVE-2026-108724

  Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint

  Sylius · Sylius

  Medium6.9
• CVE-2026-100872

  Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite

  Sylius · Sylius

  High8.7
• CVE-2026-100871

  Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication

  Sylius · Sylius

  High8.7
• CVE-2026-100870

  Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header

  Sylius · Sylius

  High8.7
• CVE-2026-100869

  Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API

  Sylius · Sylius

  High8.2
• CVE-2026-53637

  Sylius: Cart FormComponent allows modification or deletion of an already-completed order

  Sylius · Sylius

  Medium6.5
• CVE-2026-53638

  Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

  Sylius · Sylius

  Medium4.3
• CVE-2026-53639

  Sylius: IDOR on Shop Payment Request API endpoints

  Sylius · Sylius

  Medium6.3
• CVE-2026-68501

  Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

  Sylius · MolliePlugin

  Medium6.5
• CVE-2026-68500

  Sylius Mollie Plugin: Payment status forgery via the payment webhook

  Sylius · MolliePlugin

  High7.5