Medium
CVE-2026-55795
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 22
Reset filters
Medium
ghsa-78vr-q6cf-c7p6
Craft Commerce: Partial Payment Amount Without Lower Bound Validation
Low
CVE-2026-32270
Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments
High
CVE-2026-32271
Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
High
CVE-2026-32272
Craft Commerce hasVariant/hasProduct Blind SQL Injection
Medium
CVE-2026-31867
Craft Commerce: Potential IDOR in Commerce carts
Low
CVE-2026-29177
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout
Medium
CVE-2026-29176
Craft Commerce has stored XSS in Inventory Location Name
High
CVE-2026-29175
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking
High
CVE-2026-29174
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
Low
CVE-2026-29173
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table
High
CVE-2026-29172
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
Medium
CVE-2026-25522
Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation
Medium
CVE-2026-25490
Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
Medium
CVE-2026-25489
Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation
Medium
CVE-2026-25488
Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation
Medium
CVE-2026-25487
Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation
Medium
CVE-2026-25486
Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation
Medium
CVE-2026-25485
Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation
Medium
CVE-2026-25484
Craft Commerce has Stored XSS in Product Type Name
Medium
CVE-2026-25483
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
Medium
CVE-2026-25482
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.