shopware platform

Name: shopware platform
Brand: shopware

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

2critical11high9medium1low

updated 2026-10-28

vulnerabilities (33)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-37708US	critical9.8	2.36% (84th)	—	no fix	2021-08-16	≤ ≤ 6.4.3.0
CVE-2021-32717US	high7.5	1.46% (73rd)	—	no fix	2021-06-24	≤ < 6.4.1.1
CVE-2021-32711US	high7.5	1.36% (72nd)	—	no fix	2021-06-24	≤ < 6.3.5.1
CVE-2023-22731US	high8.8	1.33% (71st)	—	no fix	2023-01-17	≤ < 6.4.18.1
CVE-2021-32716US	medium4.9OT elevated	1.11% (66th)	—	no fix	2021-06-24	≤ < 6.4.1.1
CVE-2022-24747US	medium5.3	1.10% (65th)	—	no fix	2022-03-09	≤ < 6.4.8.2
CVE-2022-24871US	medium5.5	1.06% (64th)	—	no fix	2022-04-20	≤ < 6.4.10.1
CVE-2021-37711US	high8.8	1.06% (64th)	—	no fix	2021-08-16	≤ ≤ 6.4.3.0
CVE-2022-24872US	high8.1	1.05% (64th)	—	no fix	2022-04-20	≤ < 6.4.10.1
CVE-2021-37707US	high7.5	0.89% (59th)	—	no fix	2021-08-16	≤ ≤ 6.4.3.0
CVE-2021-32710US	high7.5	0.88% (59th)	—	no fix	2021-06-24	≤ < 6.3.5.2
CVE-2022-24746US	medium6.1	0.84% (58th)	—	no fix	2022-03-09	≤ < 6.4.8.1
CVE-2021-37709US	medium6.5	0.77% (56th)	—	no fix	2021-08-16	≤ ≤ 6.4.3.0
CVE-2022-24748US	high7.5OT elevated	0.76% (55th)	—	no fix	2022-03-09	≤ < 6.4.8.2
CVE-2021-37710US	medium5.4	0.74% (54th)	—	no fix	2021-08-16	≤ ≤ 6.4.3.0
CVE-2023-22732US	critical9.8	0.73% (54th)	—	no fix	2023-01-17	≤ < 6.4.18.1
CVE-2023-22733US	medium6.5	0.70% (53rd)	—	no fix	2023-01-17	≤ < 6.4.18.1
CVE-2023-22730US	high7.5	0.66% (51st)	—	no fix	2023-01-17	≤ < 6.4.18.1
CVE-2021-32709US	medium4.9OT elevated	0.63% (50th)	—	no fix	2021-06-24	≤ < 6.4.1.1
CVE-2023-22734US	high7.5	0.60% (49th)	—	no fix	2023-01-17	≤ < 6.4.18.1
CVE-2022-24745US	medium6.5	0.53% (45th)	—	no fix	2022-03-09	≤ < 6.4.8.2
CVE-2022-24744US	low3.5	0.48% (42nd)	—	no fix	2022-03-09	≤ < 6.4.8.1
CVE-2026-48015US	—	0.48% (42nd)	—	6.7.10.1	2026-07-17	2 versions
CVE-2026-48010US	—	0.47% (41st)	—	6.7.10.1	2026-07-17	2 versions
CVE-2026-48008US	—OT elevated	0.47% (41st)	—	6.7.10.1	2026-07-17	2 versions
CVE-2026-48009US	—	0.46% (39th)	—	6.7.10.1	2026-07-17	2 versions
CVE-2026-48016US	—	0.41% (35th)	—	6.7.10.1	2026-07-17	2 versions
CVE-2026-48014US	—OT elevated	0.39% (33rd)	—	6.7.10.1	2026-07-17	2 versions
CVE-2026-48013US	—	0.37% (30th)	—	6.7.10.1	2026-07-23	2 versions
CVE-2026-48012US	—	0.27% (20th)	—	6.7.10.1	2026-07-23	6.7.3.0, → 6.7.10.1
CVE-2026-31889US	—	0.27% (19th)	—	6.7.8.1	2026-03-11	2 versions
CVE-2026-31887US	high7.5OT elevated	0.24% (15th)	—	6.7.8.1	2026-03-11	2 versions
CVE-2026-31888US	—	0.23% (13th)	—	6.7.8.1	2026-03-11	2 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor5 CVEs
CWE-20Improper Input Validation3 CVEs
CWE-613Insufficient Session Expiration3 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-863Incorrect Authorization3 CVEs
CWE-918Server-Side Request Forgery (SSRF)3 CVEs
CWE-290Authentication Bypass by Spoofing2 CVEs
CWE-384Session Fixation2 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)33 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan