Login Request a demo
CO
Product
commerce
by craftcms · last CVE Sep 14, 2026
11
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 0High 4Medium 6Low 1
Severity
All severities11Critical0High4Medium6Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add commerce to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-29174
8.8
0%
Mar 10
Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting
Affected: >= 5.0.0 < 5.5.3
CVE-2026-29172
8.8
0%
Mar 10
Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting
Affected: >= 4.0.0 < 4.10.2; >= 5.0.0 < 5.5.3
CVE-2026-32272
8.7
0%
Apr 13
Craft Commerce: Blind SQL Injection via hasVariant/hasProduct
Affected: >= 5.0.0 < 5.6.0
CVE-2026-32271
7.7
0%
Apr 13
Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
Affected: >= 4.0.0, < 4.10.3; >= 5.0.0, < 5.5.5
CVE-2026-55795
6.9
1%
Sep 14
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
Affected: >= 4.0.0, < 4.11.2; >= 5.0.0, < 5.6.5
CVE-2026-29177
5.4
0%
Mar 10
Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout
Affected: >= 4.0.0 < 4.10.2; >= 5.0.0 < 5.5.3
CVE-2026-29175
5.4
0%
Mar 10
Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking
Affected: >= 5.0.0 < 5.5.3
CVE-2026-31867
4.8
0%
Mar 11
Craft Commerce has a Potential IDOR in Commerce carts
Affected: >= 4.0.0, < 4.11.0; >= 5.0.0, < 5.6.0
CVE-2026-29176
4.8
0%
Mar 10
Craft Commerce has Stored XSS in Inventory Location Name
Affected: >= 4.0.0 < 4.10.2; >= 5.0.0 < 5.5.3
CVE-2026-29173
4.8
0%
Mar 10
Craft Commerce has Stored XSS while updating Order Status from Orders Table
Affected: >= 4.0.0 < 4.10.2; >= 5.0.0 < 5.5.3
CVE-2026-32270
1.7
0%
Apr 13
Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments
Affected: >= 4.0.0, < 4.11.0; >= 5.0.0, < 5.6.0
Showing 11