shopware vulnerabilities

CVEs per yearBy the year they were published

1. 202113
2. 202216
3. 20238
4. 20249
5. 20255
6. 202615

Newest CVEs

• CVE-2026-104937

  CVE-2026-104937

  Shopware · Shopware

  High8.1
• CVE-2026-48012

  Shopware SSO referer trust leading to an arbitrary redirect target

  shopware · shopware

  Medium4.3
• CVE-2026-48013

  Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

  shopware · shopware

  Medium4.1
• CVE-2026-48009

  Shopware: Admin Account Takeover via User Recovery Hash Exposure

  shopware · shopware

  Medium6.8
• CVE-2026-48014

  Shopware: Admin API ACL Bypass in Order State Transition Endpoints

  shopware · shopware

  Medium6.5
• CVE-2026-48010

  Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts

  shopware · shopware

  Medium6.5
• CVE-2026-48016

  Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

  shopware · shopware

  Medium4.3
• CVE-2026-48015

  Shopware: Stored XSS via SVG file upload — no SVG sanitization

  shopware · shopware

  Medium4.9
• CVE-2026-48008

  Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

  shopware · shopware

  Medium6.5
• CVE-2026-48011

  Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

  shopware · shopware

  Low3.7