S
Vendor security profile
Sylius
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs7
Critical0
CISA KEV0
Public exploit1
Patch rate%86
Avg. CVSS7.4
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
6
1
CVE KEV
CVE severity distribution
7toplam CVE
High4 (57%)
Medium3 (43%)
Patch and exploitation view
%86
Verified patch
%0
CISA KEV
%14
Public exploit
6Patch available
0Partial
0Workaround
0Vendor: no patch
1Unknown
Latest vulnerabilities
6.9
CVE-2026-108724
Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint
S
Patch status unknown
8.7
CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
S
Patch verifiedEPSS %0
8.7
CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
S
Patch verifiedEPSS %0
8.7
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
S
Patch verifiedEPSS %0
8.2
CVE-2026-100869
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
S
Patch verifiedEPSS %0
4.3
CVE-2026-53638
Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
S
Patch verifiedEPSS %0
6.3
CVE-2026-53639
Sylius: IDOR on Shop Payment Request API endpoints
S
Patch verifiedEPSS %1