Login Request a demo
SH
Product
shopper
by shopperlabs · last CVE Oct 28, 2026
14
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 1High 7Medium 6Low 0
Severity
All severities14Critical1High7Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add shopper to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-56830
6.5
0%
Sep 15
Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization
Affected: < 2.9.2
CVE-2026-56831
6.5
0%
Sep 15
Shopper: Negative discount values accepted and propagated through order calculation pipeline
Affected: < 2.9.0
CVE-2026-47742
6.5
0%
May 29
Shopper: Missing authorization on Product admin Livewire sub-form components
Affected: < 2.8.0
CVE-2026-47745
6.5
0%
May 29
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Affected: < 2.8.0
CVE-2026-47741
5.9
0%
May 29
Shopper: Race condition on Discount.usage_limit allows silent over-redemption
Affected: < 2.8.0
CVE-2026-56826
5.4
0%
Oct 13
Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration
Affected: >= 2.0.0, < 2.9.2
Showing 6