saleor vulnerabilities
21 published CVEs name saleor among the affected products.
- 21Published CVEs21 of them scored
- 10Last 12 monthspublished in the last year
- 0Critical7 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-44472
Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge
saleor · saleor
High8.1 - CVE-2026-48744
Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check
saleor · saleor
Medium6.5 - CVE-2026-42175
requests-hardened: Server-Side Request Forgery (SSRF) in requests-hardened RFC 6598
saleor · requests-hardened
Medium6.5 - CVE-2026-39851
Saleor has a user enumeration vulnerability due to different error messages
saleor · saleor
Medium5.3 - CVE-2026-35407
Saleor has Cross-Account Email Change via Unbound Confirmation Token
saleor · saleor
Medium5.9 - CVE-2026-35401
Saleor has a resource exhaustion vulnerability in GraphQL queries
saleor · saleor
High7.5 - CVE-2026-33756
Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching
saleor · saleor
High7.5 - CVE-2026-24136
Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API
saleor · saleor
High8.7 - CVE-2026-23499
Saleor vulnerable to stored XSS via Unrestricted File Upload
saleor · saleor
High8.5 - CVE-2026-22849
Saleor lacks proper HTML sanitization in rich text fields
saleor · saleor
High7.2