Skip to content
OpenAdvisories

Package · npm

@vendure/core

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-63461

    Vendure: Shop API list queries can return non-public entities when filterOperator is OR

    Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperato…

    vendurehq vendure @vendure/core npm
  • Medium 5.3
    GHSA-wm63-7627-ch33

    @vendure/core's insecure currencyCode handling allows wrong payment amounts

    ### Impact Currently, in many Vendure deployments it's possible to select any currencyCode (really any, doesn't need to be assigned to the channel) and pay through Mollie and Stripe in that particular currencyCode. The prices are not transformed. The result i…

    @vendure/core npm