Vendurehq Vendure
7 CVEs affecting Vendurehq Vendure. Latest disclosed: 2026-09-17. Critical: 2, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63472 | Critical | 9.1 | 2026-09-17 | Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/… |
CVE-2026-40887 | Critical | 9.1 | 2026-04-21 | Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection… |
CVE-2026-63459 | High | 8.7 | 2026-09-17 | Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-… |
CVE-2026-63460 | High | 7.5 | 2026-09-17 | Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically… |
CVE-2026-67347 | Medium | 6.8 | 2026-07-30 | Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts u… |
CVE-2026-63461 | Medium | 5.3 | 2026-09-17 | Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibilit… |
CVE-2026-25050 | Medium | 5.3 | 2026-01-30 | Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timin… |