CVE-2026-42175 | Medium | 6.5 | 2026-05-12 | requests-hardened is a library that overrides the default behaviors of the requests library, and adds new security features. Prior to , the SSRF protection in… |
CVE-2026-39851 | Medium | 4.3 | 2026-04-08 | Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the requestEmailChange() mutation was revealing the existence… |
CVE-2026-35407 | Medium | 6.5 | 2026-04-08 | Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the acco… |
CVE-2026-35401 | High | 7.5 | 2026-04-08 | Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can include many GraphQL mutations or querie… |
CVE-2026-33756 | High | 7.5 | 2026-04-08 | Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL… |
CVE-2026-24136 | High | 7.5 | 2026-01-24 | Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Re… |
CVE-2026-23499 | Medium | 5.4 | 2026-01-21 | Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor allowed authenticated staff users or A… |
CVE-2026-22849 | Medium | 4.8 | 2026-01-21 | Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text… |
CVE-2025-58442 | Medium | 5.3 | 2025-09-09 | Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of `accountRegister` may r… |
CVE-2024-31205 | Medium | 4.2 | 2024-04-08 | Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may by… |
CVE-2024-29888 | Medium | 4.2 | 2024-03-27 | Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific co… |
CVE-2024-29036 | Medium | 4.3 | 2024-03-20 | Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the… |
CVE-2023-3294 | Medium | 6.1 | 2023-06-16 | Cross-site Scripting (XSS) - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7. |
CVE-2023-32694 | Medium | 4.8 | 2023-05-25 | Saleor Core is a composable, headless commerce API. Saleor's `validate_hmac_signature` function is vulnerable to timing attacks. Malicious users could abuse th… |
CVE-2023-26052 | Low | 3.7 | 2023-03-02 | Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus… |
CVE-2023-26051 | Medium | 6.5 | 2023-03-02 | Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus… |
CVE-2022-39275 | Medium | 5.3 | 2022-10-06 | Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to acce… |
CVE-2022-0932 | Medium | 6.5 | 2022-03-11 | Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2. |
CVE-2019-1010304 | Medium | 5.3 | 2019-07-15 | Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorr… |