Saleor 3.23.0 Alpha 2
Approved changes feed: RSS · Atom
cpe:2.3:a:saleor:saleor:3.23.0:alpha2:*:*:*:*:*:*
part: a version: 3.23.0 update: alpha2
| Vendor | Saleor (fbec566e-ae4f-5c49-a898-f36a646d9d76) |
|---|---|
| Product | Saleor (e31d7f02-6ba6-5f8b-83dc-f92e4c4d9836) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/saleor/saleor |
purl2cpe | 2026-06-01 10:13:18.682981 |
pkg:pypi/saleor |
purl2cpe | 2026-06-01 10:13:18.682982 |
pkg:sourceforge/saleor.mirror |
purl2cpe | 2026-06-01 10:13:18.682984 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-39851 |
vulnerable | 2026-06-08 08:01:17.111358 |
Saleor has a user enumeration vulnerability due to different error messages
Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the requestEmailChange() mutation was revealing the existence of user-provided email addresses in error messages. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Published: 2026-04-08T17:33:37.998Z
Updated: 2026-04-08T19:22:20.422Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-35401 |
vulnerable | 2026-06-08 07:59:13.833715 |
Saleor has a resource exhaustion vulnerability in GraphQL queries
HIGH (7.5)
Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can include many GraphQL mutations or queries in a single API call using aliases or chaining multiple mutations, resulting in resource exhaustion. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Published: 2026-04-08T17:22:10.683Z
Updated: 2026-04-08T19:21:37.796Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33756 |
vulnerable | 2026-06-08 07:59:10.717941 |
Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching
HIGH (7.5)
Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthenticated attacker to send a single HTTP request many operations (bypassing the per query complexity limit) to exhaust resources. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Published: 2026-04-08T17:07:57.920Z
Updated: 2026-04-08T18:42:28.521Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.