vendurehq vendure

4 known vulnerabilities in vendurehq vendure, 1 critical, with patch priority, exploit likelihood and the news covering them.

Latest vulnerabilities

  • CVE-2026-63472 CVSS 9.1 critical Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in…
  • CVE-2026-63461 CVSS 5.3 medium Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries…
  • CVE-2026-63460 CVSS 7.5 high Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to…
  • CVE-2026-63459 CVSS 8.7 high Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in…