shopware has 3 CVEs on record between 2025 and 2026. 1 was published in the last 90 days. The median CVSS is 7.6 (high). Most affected products: Shopware (2), shopware/core (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.6
- Publish → KEV
- —
- Last 90 days
- 1 prev 0
Worst active — by depth score
CVE-2026-104937High· 8.1Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS)45CVE-2026-31887HighShopware: Unauthenticated data extraction possible through store-api.order endpoint41CVE-2025-67648High· 7.1Shopware is an open commerce platform39
shopware vulnerabilities
CVEs affecting shopware, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-104937High· 8.1Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS)
Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded J…
CVE-2026-31887HighShopware: Unauthenticated data extraction possible through store-api.order endpoint
Shopware: Unauthenticated data extraction possible through store-api.order endpoint
CVE-2025-67648High· 7.1Shopware is an open commerce platform
Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Tw…