[ Vendor · 1 CVEs ]
spree
CVEs affecting spree published in the last 30 days, plus any spree CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-94462 | 22 Sep 2026 | CVSS 7.1 | Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in… | Fix |