tag
Saleor
High
Saleor Stored XSS via Unrestricted File Upload (CVE-2026-23499)
CVE-2026-23499·
Saleor (saleor/saleor)
patched
High
Saleor Rich Text (EditorJS) Field Stored XSS (CVE-2026-22849)
CVE-2026-22849 (GHSA-8jcj-r5g2-qrpv)·
Saleor (open-source e-commerce platform), rich text fields (EditorJS content on pages/products)
unpatched
High
Saleor GraphQL IDOR — Unauthenticated Order PII Exfiltration (CVE-2026-24136)
CVE-2026-24136·
Saleor e-commerce platform (GraphQL API)
patched