CVE-2026-25757 | Medium | 5.3 | 2026-02-06 | Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view complet… |
CVE-2026-25758 | High | 7.5 | 2026-02-06 | Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows… |
CVE-2026-22589 | High | 7.5 | 2026-01-10 | Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Obj… |
CVE-2026-22588 | Medium | 6.5 | 2026-01-08 | Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Objec… |
CVE-2011-10026 | Critical | 9.8 | 2025-08-20 | Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows att… |
CVE-2011-10019 | Critical | 9.8 | 2025-08-13 | Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitiz… |
CVE-2021-41275 | Critical | 9.3 | 2021-11-17 | spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an un… |
CVE-2020-26223 | High | 7.7 | 2020-11-13 | Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is… |
CVE-2013-2506 | | | 2013-03-08 | app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which… |
CVE-2013-1656 | | | 2013-03-08 | Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1)… |
CVE-2008-7311 | | | 2012-04-05 | The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for… |
CVE-2008-7310 | | | 2012-04-05 | Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value… |
CVE-2010-3978 | | | 2010-11-17 | Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which a… |