[ Vendor · 5 CVEs ]
Sylius
CVEs affecting Sylius published in the last 30 days, plus any Sylius CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-108724 | 11 Oct 2026 | CVSS 5.3 | SyliusSylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product… | |
| CVE-2026-100869 | 27 Sep 2026 | CVSS 5.9 | SyliusSylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on… | |
| CVE-2026-100870 | 27 Sep 2026 | CVSS 8.8 | SyliusSylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without… | |
| CVE-2026-100871 | 27 Sep 2026 | CVSS 8.8 | SyliusSylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin… | |
| CVE-2026-100872 | 27 Sep 2026 | CVSS 7.5 | SyliusSylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify… |