vendurehq vendure
7 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-63459 | < 3.6.5 | Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions | HIGH 8.7 | 0.4 % | ||
| CVE-2026-63461 | >= 1.0.0, < 3.6.5 | Vendure: Shop API list queries can return non-public entities when filterOperator is OR | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-63472 | < 3.7.0 | Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification | CRITICAL 9.1 | 0.6 % | ||
| CVE-2026-63460 | < 3.6.5 | Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends | HIGH 7.5 | 0.6 % | ||
| CVE-2026-67347 | ≤ 3.7.1 | Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update | MEDIUM 6.1 | 0.5 % | ||
| CVE-2026-40887 | >= 3.0.0, < 3.5.7 ; >= 3.6.0, < 3.6.2 ; >= 1.7.4, < 2.3.4 | @vendure/core has a SQL Injection vulnerability | CRITICAL 9.1 | 1.8 % | ||
| CVE-2026-25050 | < 3.5.3 | Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy | LOW 2.7 | 0.4 % |