npm/@vendure/core

Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

Modified: 2/3/2026

Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

Modified: 9/17/2026

@vendure/core has a SQL Injection vulnerability

Modified: 5/5/2026

Vendure Cross Site Request Forgery vulnerability impacting all API requests

Modified: 7/11/2023

Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

Modified: 9/25/2026

@vendure/core's insecure currencyCode handling allows wrong payment amounts

Modified: 11/17/2023

Vendure: Shop API list queries can return non-public entities when filterOperator is OR

Modified: 9/17/2026