PL
Product
platform
11
CVEs
0
On KEV
8.9
Max CVSS
0
New 30D
Severity mix
Critical 0High 2Medium 9Low 0
Watch
Add platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48009 | 6.8 | Jul 17 | Shopware: Admin Account Takeover via User Recovery Hash Exposure Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2026-48014 | 6.5 | Jul 17 | Shopware: Admin API ACL Bypass in Order State Transition Endpoints Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2026-48010 | 6.5 | Jul 17 | Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2026-48008 | 6.5 | Jul 17 | Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2026-31888 | 5.3 | Mar 11 | Shopware has user enumeration via distinct error codes on Store API login endpoint Affected: >= 6.7.0.0, < 6.7.8.1; < 6.6.10.14 |
| CVE-2026-48015 | 4.9 | Jul 17 | Shopware: Stored XSS via SVG file upload — no SVG sanitization Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2026-48012 | 4.3 | Jul 23 | Shopware SSO referer trust leading to an arbitrary redirect target Affected: >= 6.7.3.0, < 6.7.10.1 |
| CVE-2026-48016 | 4.3 | Jul 17 | Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2026-48013 | 4.1 | Jul 23 | Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
Showing 9