Sylius vulnerabilities
35 published CVEs name Sylius among the affected products.
- 35Published CVEs35 of them scored
- 17Last 12 monthspublished in the last year
- 2Critical10 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-108724
Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint
Sylius · Sylius
Medium6.9 - CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
Sylius · Sylius
High8.7 - CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
Sylius · Sylius
High8.7 - CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
Sylius · Sylius
High8.7 - CVE-2026-100869
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
Sylius · Sylius
High8.2 - CVE-2026-53637
Sylius: Cart FormComponent allows modification or deletion of an already-completed order
Sylius · Sylius
Medium6.5 - CVE-2026-53638
Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
Sylius · Sylius
Medium4.3 - CVE-2026-53639
Sylius: IDOR on Shop Payment Request API endpoints
Sylius · Sylius
Medium6.3 - CVE-2026-68501
Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII
Sylius · MolliePlugin
Medium6.5 - CVE-2026-68500
Sylius Mollie Plugin: Payment status forgery via the payment webhook
Sylius · MolliePlugin
High7.5