SH
Vendor
shopperlabs
14
CVEs
0
On KEV
3
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-56828 New | SH shopper shopperlabs | 8.8 | Oct 28 | Shopper: read-only team permissions allow administrator creation and permission escalation |
| CVE-2026-114387 | SH shopper shopperlabs | 8.8 | Oct 21 | Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components |
| CVE-2026-56826 | SH shopper shopperlabs | 5.4 | Oct 13 | Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration |
| CVE-2026-56830 | SH shopper shopperlabs | 6.5 | Sep 15 | Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization |
| CVE-2026-56831 | SH shopper shopperlabs | 6.5 | Sep 15 | Shopper: Negative discount values accepted and propagated through order calculation pipeline |
| CVE-2026-56827 | SH shopper shopperlabs | 8.1 | Sep 15 | Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers |
| CVE-2026-56829 | SH shopper shopperlabs | 8.1 | Sep 15 | Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component |
| CVE-2026-56825 | SH shopper shopperlabs | 8.1 | Sep 15 | Shopper: Missing authorization on product removal actions in CollectionProducts component |
| CVE-2026-47743 | SH shopper shopperlabs | 8.7 | Jul 23 | Shopper: Multiple data integrity and disclosure issues in admin Livewire components |
| CVE-2026-47740 | SH shopper shopperlabs | 8.1 | May 29 | Shopper: Authorization bypass in multiple Livewire admin components |
| CVE-2026-47741 | SH shopper shopperlabs | 5.9 | May 29 | Shopper: Race condition on Discount.usage_limit allows silent over-redemption |
| CVE-2026-47742 | SH shopper shopperlabs | 6.5 | May 29 | Shopper: Missing authorization on Product admin Livewire sub-form components |
| CVE-2026-47744 | SH shopper shopperlabs | 9.9 | May 29 | Shopper: Authorization bypass and RBAC privilege escalation in team settings |
| CVE-2026-47745 | SH shopper shopperlabs | 6.5 | May 29 | Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables |