CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 17/07/2026 |
| CVE-2026-48015 | MEDIUM4.9 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSave | 17/07/2026 |
| CVE-2026-48014 | MEDIUM6.5 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action/order/{orderId}/state/{transition} and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare PlatformRequest::ATTRIBUTE_ACL or per | 17/07/2026 |
| CVE-2026-48010 | MEDIUM6.5 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEM_SCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission can set admin: true | 17/07/2026 |
| CVE-2026-48009 | MEDIUM6.8 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:read ACL can take over any admin account by triggering POST /api/_action/user/user-recovery, reading the password recovery hash through POST /api/search/user-recovery, and using PATCH /api/_action/user/ | 17/07/2026 |
| CVE-2026-48008 | MEDIUM6.5 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/_action/sync; the regular integration endpoint POST /api/integration blocks thi | 17/07/2026 |
| CVE-2026-48011 | LOW3.7 | Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue. | 10/06/2026 |
| CVE-2026-31889 | HIGH8.9 | Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopware app registration flow that could, under specific conditions, allow attackers to take over the communication channel between a shop and an app. The legacy app registration flow used HMAC‑based authentication without su | 11/03/2026 |
| CVE-2026-31888 | MEDIUM5.3 | Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, the Store API login endpoint (POST /store-api/account/login) returns different error codes depending on whether the submitted email address belongs to a registered customer (CHECKOUT__CUSTOMER_AUTH_BAD_CREDENTIALS) or is unknown (CHECKOUT__CUSTOMER_ | 11/03/2026 |
| CVE-2026-31887 | HIGH7.5 | Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. This vulnerability is fixed in 6.7.8.1 and 6.6.10.15. | 11/03/2026 |
| GHSA-r2vg-hvjm-fg38 | MEDIUM4.3 | Shopware Customer Orders can be canceled, even if refunds are disabled | 21/10/2025 |
| GHSA-27c9-vp3w-6ww8 | MEDIUM4.9 | Shopware exposes sensitive user information via CSV export mapping | 21/10/2025 |
| GHSA-3cpp-fv95-mpr5 | LOW2.7 | Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice | 21/10/2025 |
| GHSA-6wh5-mw9h-5c3w | LOW2.7 | Shopware vulnerable to path traversal via Plugin upload | 21/10/2025 |
| GHSA-m895-2hj3-8cg9 | MEDIUM5.3 | Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually | 21/10/2025 |
| CVE-2025-7954 | HIGH8.1 | A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations. | 06/08/2025 |
| CVE-2025-27892 | MEDIUM6.8 | Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression. | 15/04/2025 |
| CVE-2025-32378 | MEDIUM5.3 | Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registered customers set to disa | 09/04/2025 |