Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 405,496All CVEsplus 19,165 rejected
- 598Last 24 hours4,935 in the last 7 days
- 18,770Last 30 days1,596 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 4 | 10 | 1 | 0 | 15 | 66 |
| 2025 | 0 | 2 | 3 | 0 | 0 | 5 | 51 |
| 2024 | 1 | 5 | 3 | 0 | 0 | 9 | 46 |
| 2023 | 1 | 1 | 4 | 2 | 0 | 8 | 37 |
| 2022 | 0 | 3 | 11 | 2 | 0 | 16 | 29 |
| 2021 | 1 | 4 | 8 | 0 | 0 | 13 | 13 |
| Title | ||
|---|---|---|
| CVE-2026-104937 | CVE-2026-104937Shopware · Shopware | High8.1 |
| CVE-2026-48012 | Shopware SSO referer trust leading to an arbitrary redirect targetPublic exploitshopware · shopware | Medium4.3 |
| CVE-2026-48013 | Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validationshopware · shopware | Medium4.1 |
| CVE-2026-48009 | Shopware: Admin Account Takeover via User Recovery Hash Exposureshopware · shopware | Medium6.8 |
| CVE-2026-48014 | Shopware: Admin API ACL Bypass in Order State Transition Endpointsshopware · shopware | Medium6.5 |
| CVE-2026-48010 | Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accountsshopware · shopware | Medium6.5 |
| CVE-2026-48016 | Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-paymentshopware · shopware | Medium4.3 |
| CVE-2026-48015 | Shopware: Stored XSS via SVG file upload — no SVG sanitizationshopware · shopware | Medium4.9 |
| CVE-2026-48008 | Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypassshopware · shopware | Medium6.5 |
| CVE-2026-48011 | Shopware: Timing-attack on admin panel allowing enumeration of administrator usernamesPublic exploitshopware · shopware | Low3.7 |
| CVE-2026-32142 | shopware/commercial: `/api/_info/config` route exposes information about licensesshopware · commercial | Medium5.3 |
| CVE-2026-31889 | Shopware has a potential take over of app credentialsshopware · core | High8.9 |
| CVE-2026-31888 | Shopware has user enumeration via distinct error codes on Store API login endpointshopware · core | Medium5.3 |
| CVE-2026-31887 | Shopware unauthenticated data extraction possible through store-api.order endpointshopware · core | High8.9 |
| CVE-2026-23498 | Shopware Improper Control of Generation of Code in Twig rendered viewsshopware · shopware | High7.2 |
| CVE-2025-67648 | Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Pageshopware · shopware | High7.1 |
| CVE-2025-7954 | Race Condition in Shopware Voucher SubmissionPublic exploitShopware · Shopware | Medium6.0 |
| CVE-2025-32378 | Shopware's default newsletter opt-in settings allow for mass sign-up abuseshopware · shopware | Medium6.9 |
| CVE-2025-30150 | Shopware 6 allows attackers to check for registered accounts through the store-apishopware · shopware | Medium5.5 |
| CVE-2025-30151 | Shopware allows Denial Of Service via password lengthshopware · shopware | High7.5 |
| CVE-2024-42357 | Shopware vulnerable to blind SQL-injection in DAL aggregationsshopware · shopware | High7.3 |
| CVE-2024-42356 | Shopware vulnerable to Server Side Template Injection in Twig using Context functionsPublic exploitshopware · shopware | High8.3 |
| CVE-2024-42355 | Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tagshopware · shopware | High8.3 |
| CVE-2024-42354 | Shopware vulnerable to Improper Access Control with ManyToMany associations in store-apishopware · shopware | Medium5.3 |
| CVE-2024-31447 | Shopware has Improper Session Handling in store-apishopware · shopware | Medium5.3 |
| CVE-2024-27917 | Shopware's session is persistent in Cache for 404 pagesshopware · shopware | High7.5 |
| CVE-2024-22406 | Blind SQL-injection in DAL aggregations in Shopwareshopware · shopware | Critical9.3 |
| CVE-2024-22407 | Broken Access Control order API in Shopwareshopware · shopware | Medium4.9 |
| CVE-2024-22408 | Server-Side Request Forgery (SSRF) in Shopware Flow Buildershopware · shopware | High7.6 |
| CVE-2023-34099 | Improper mail validation in Shopwareshopware · shopware | Medium5.3 |
| CVE-2023-34098 | Dependency configuration exposed in Shopwareshopware · shopware | Medium5.3 |
| CVE-2023-23941 | SwagPayPal payment not sent to PayPal correctlyshopware · SwagPayPal | High7.5 |
| CVE-2023-22733 | Improper Output Neutralization in Log Module in shopwareshopware · platform | Low2.7 |
| CVE-2023-22732 | Insufficient Session Expiration in Administration in shopwareshopware · platform | Low3.7 |
| CVE-2023-22731 | Improper Control of Generation of Code in Twig rendered views in shopwareshopware · platform | Critical10.0 |
| CVE-2023-22730 | Improper Input Validation of Clearance sale in cartshopware · platform | Medium5.3 |
| CVE-2023-22734 | Improper Input Newsletter subscription option validation in shopwareshopware · platform | Medium4.3 |
| CVE-2022-36102 | Acess control list bypassed via crafted specific URLsshopware · shopware | Medium6.3 |
| CVE-2022-36101 | Sensitive data in backend customer moduleshopware · shopware | Medium5.4 |
| CVE-2022-31148 | Persistent cross site scripting in customer module in Shopwareshopware · shopware | Medium5.4 |
| CVE-2022-31057 | Authenticated Stored XSS in Shopware Administrationshopware · shopware | Medium6.5 |
| CVE-2022-24892 | Multiple valid tokens for password reset in Shopwareshopware · shopware | Medium6.4 |
| CVE-2022-24879 | Malfunction of Cross-Site Request Forgery token validationshopware · shopware | High7.5 |
| CVE-2022-24873 | Non-Stored Cross-site Scripting in Shopware storefrontshopware · shopware | Medium5.4 |
| CVE-2022-24872 | Improper Access Control in shopwareshopware · platform | High8.1 |
| CVE-2022-24871 | Server-Side Request Forgery (SSRF) in Shopwareshopware · platform | High7.2 |
| CVE-2022-24744 | Insufficient Session Expiration in shopwareshopware · platform | Low2.6 |
| CVE-2022-24745 | Guest session is shared between customers in shopwareshopware · platform | Medium4.8 |
| CVE-2022-24746 | HTML injection possibility in voucher code formshopware · platform | Medium6.1 |
| CVE-2022-24747 | HTTP caching is marking private HTTP headers as publicshopware · platform | Medium6.3 |