SY
Product
Sylius
27
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 5Medium 22Low 0
Watch
Add Sylius to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-100871 | 8.8 | Sep 27 | Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication Affected: 1.11.0 before 1.12.25; 1.13.0 before 1.13.17; 1.14.0 before 1.14.20; 2.0.0 before 2.1.16; 2.2.0 before 2.2.9 |
| CVE-2026-100870 | 8.8 | Sep 27 | Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header Affected: 1.12.0 before 1.12.25; 1.13.0 before 1.13.17; 1.14.0 before 1.14.20; 2.0.0 before 2.1.16; 2.2.0 before 2.2.9 |
| CVE-2022-24743 | 8.2 | Mar 14 | Sylius is an open source eCommerce platform Affected: 1.10.0 before 1.10.11; 1.11.0 before 1.11.2 |
| CVE-2026-100872 | 7.5 | Sep 27 | Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite Affected: 2.0.0 before 2.1.16; 2.2.0 before 2.2.9 |
| CVE-2024-57610 | 7.5 | Feb 6 | A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account… Affected: 2.0.2 |
Showing 5