Saleor

Saleor Stored XSS via Unrestricted File Upload (CVE-2026-23499) newCVE-2026-23499webHIGHPatched2026-07-05Saleor Rich Text (EditorJS) Field Stored XSS (CVE-2026-22849) newCVE-2026-22849webHIGHPatched2026-07-05Saleor GraphQL IDOR — Unauthenticated Order PII Exfiltration (CVE-2026-24136) newCVE-2026-24136webHIGH 7.5Patched2026-07-05