MEDIUMRubyGems
GHSA-7h48-m3rw-vr27· CVE-2008-7310Spree does not properly restrict the use of a hash to provide values for a model's attributes
Modified: 12/7/2024
package
RubyGems/spree
pkg:rubygems/spree
CRITICAL9.8RubyGems
GHSA-97vm-c39p-jr86· CVE-2011-10019Spree has Remote Command Execution vulnerability in search functionality
Modified: 6/9/2026
HIGH7.4RubyGems
GHSA-f8cm-364f-q9qh· CVE-2020-15269Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls
Modified: 7/8/2026
MEDIUMRubyGems
GHSA-g466-57gh-cqfw· CVE-2008-7311Spree uses a hardcoded hash value
Modified: 12/7/2024
MEDIUMRubyGems
GHSA-hwrx-wc75-mgh7· CVE-2010-3978Spree allows remote attackers to obtain sensitive information
Modified: 12/5/2024
MEDIUMRubyGems
GHSA-jxx8-v83v-rhw3· CVE-2013-1656Spree Improper Input Validation vulnerability
Modified: 12/5/2024
CRITICALRubyGems
GHSA-x485-rhg3-cqr4· CVE-2011-10026Spree Commerce is vulnerable to RCE through Search API
Modified: 12/1/2025
MEDIUMRubyGems
GHSA-xf4v-w5x5-pv79Spree: CSV Formula Injection in Customer Export
Modified: 6/4/2026