영향받는 버전 라인
알려진 취약점
| CVE | 제목 | 영향 버전 | CVSS | 악용 | EPSS | 공개일 |
|---|---|---|---|---|---|---|
| CVE-2026-63459 | Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions | * | 8.7 | — | 2026-09-17 | |
| CVE-2026-63461 | Vendure: Shop API list queries can return non-public entities when filterOperator is OR | * | 5.3 | — | 2026-09-17 | |
| CVE-2026-63472 | Vendure: External-authentication account takeover: external login linked to a pre-existing account by email wi... | * | 9.1 | — | 2026-09-17 | |
| CVE-2026-63460 | Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends | * | 7.5 | — | 2026-09-17 | |
| CVE-2026-67347 | Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update | ≤ 3.7.1 | 6.1 | — | 2026-07-30 | |
| CVE-2026-40887 | @vendure/core has a SQL Injection vulnerability | * | 9.1 | — | 2026-04-22 | |
| CVE-2026-25050 | Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy | * | 2.7 | — | 2026-01-31 |
내 서버의 버전을 직접 추적하세요
InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.
데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).