@vendure/core vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-63472Critical@vendure/core: Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification CVE-2026-63461Medium@vendure/core: Vendure: Shop API list queries can return non-public entities when filterOperator is OR CVE-2026-63460High@vendure/core: Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends CVE-2026-40887Critical@vendure/core: @vendure/core has a SQL Injection vulnerability CVE-2026-25050Low@vendure/core: Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy GHSA-WM63-7627-CH33Medium@vendure/core: @vendure/core's insecure currencyCode handling allows wrong payment amounts GHSA-H9WQ-XCQX-MQXMLow@vendure/core: Vendure Cross Site Request Forgery vulnerability impacting all API requests

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo