Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how shopware compares to other vendors in security performance

View Risk Score →

Shopware Shopwareshopware/commercial: `/api/_info/config` route exposes information about licenses

Risk 19
Severity
5.3
EPSS
0.04%
First published (updated )
CVE-2026-32142

Shopware Shopwareswag/platform-security: `/api/_info/config` route exposes information about licenses and active security fixes

Risk 19
Severity
5.3
EPSS
0.04%
First published (updated )
CVE-2026-32100

Shopware ShopwareShopware has a potential take over of app credentials

Risk 53
Severity
8.9
EPSS
0.08%
First published (updated )
CVE-2026-31889

Shopware ShopwareShopware has user enumeration via distinct error codes on Store API login endpoint

Risk 19
Severity
5.3
EPSS
0.05%
First published (updated )
CVE-2026-31888

Shopware ShopwareShopware unauthenticated data extraction possible through store-api.order endpoint

Risk 33
Severity
8.9
EPSS
0.04%
First published (updated )
CVE-2026-31887
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/shopware/coreShopware Improper Control of Generation of Code in Twig rendered views

Risk 49
Severity
7.2
EPSS
0.06%
First published (updated )
CVE-2026-23498

composer/shopware/storefrontShopware's inproper input validation can lead to Reflected XSS through Storefront Login Page

Risk 47
Severity
7.1
First published (updated )
CVE-2025-67648

Shopware ShopwareRace Condition in Shopware Voucher Submission

Risk 54
Severity
6
EPSS
0.04%
First published (updated )
CVE-2025-7954

Shopware Shopware 6XSS, CSRF

Risk 38
Severity
6.1
First published (updated )
CVE-2025-51541

composer/shopware/platformShopware's default newsletter opt-in settings allow for mass sign-up abuse

Risk 23
Severity
6.9
EPSS
0.06%
First published (updated )
CVE-2025-32378
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Shopware ShopwareSQL Injection

Risk 51
Severity
7.3
First published (updated )
CVE-2025-27892

composer/shopware/platformShopware 6 allows attackers to check for registered accounts through the store-api

Risk 28
Severity
5.5
First published (updated )
CVE-2025-30150

Shopware ShopwareShopware allows Denial Of Service via password length

Risk 43
Severity
7.5
First published (updated )
CVE-2025-30151

composer/shopware/coreShopware vulnerable to blind SQL-injection in DAL aggregations

Risk 89
Severity
9.8
First published (updated )
CVE-2024-42357

composer/shopware/coreShopware vulnerable to Server Side Template Injection in Twig using Context functions

Risk 72
Severity
8.3
First published (updated )
CVE-2024-42356
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/shopware/coreShopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag

Risk 89
Severity
9.8
First published (updated )
CVE-2024-42355

composer/shopware/platformShopware vulnerable to Improper Access Control with ManyToMany associations in store-api

Risk 37
Severity
5.9
First published (updated )
CVE-2024-42354

composer/shopware/platformShopware has Improper Session Handling in store-api

Risk 24
Severity
5.3
EPSS
0.04%
First published (updated )
CVE-2024-31447

composer/shopware/platformShopware's session is persistent in Cache for 404 pages

Risk 31
Severity
7.5
EPSS
0.04%
First published (updated )
CVE-2024-27917

composer/shopware/platformBlind SQL-injection in DAL aggregations in Shopware

Risk 62
Severity
9.8
EPSS
0.09%
First published (updated )
CVE-2024-22406
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/shopware/platformBroken Access Control order API in Shopware

Risk 28
Severity
6.5
EPSS
0.05%
First published (updated )
CVE-2024-22407

Shopware ShopwareServer-Side Request Forgery (SSRF) in Shopware Flow Builder

Risk 43
Severity
8.1
EPSS
0.05%
First published (updated )
CVE-2024-22408

composer/shopware/shopwareImproper mail validation in Shopware

Risk 27
Severity
5.3
First published (updated )
CVE-2023-34099

composer/shopware/shopwareDependency configuration exposed in Shopware

Risk 27
Severity
5.3
First published (updated )
CVE-2023-34098

composer/shopware/shopwareXSS

Risk 38
Severity
6.1
First published (updated )
CVE-2022-48150
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Shopware ShopwareImproper Control of Generation of Code in Twig Rendered Views in Shopware

Risk 79
Severity
8.8
First published (updated )
CVE-2023-2017

Shopware SwagPayPalSwagPayPal payment not sent to PayPal correctly

Risk 43
Severity
7.5
First published (updated )
CVE-2023-23941

Shopware ShopwareImproper Output Neutralization in Log Module in shopware

Risk 38
Severity
6.5
First published (updated )
CVE-2023-22733

Shopware ShopwareInsufficient Session Expiration in Administration in shopware

Risk 86
Severity
9.8
First published (updated )
CVE-2023-22732

Shopware ShopwareImproper Control of Generation of Code in Twig rendered views in shopware

Risk 83
Severity
10
First published (updated )
CVE-2023-22731
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203