@semic/testing (2.2.11), @vendure/dashboard (>=3.2.2, <=3.4.4) potentially affected by CVE-2026-63472 via @vendure/core (>=3.0.0, <=3.4.4)

@vendure/core NPM version =3.0.0, =3.2.2, =3.4.4 Source cves: CVE-2026-63472 Source advisory: OSV:GHSA-6J36-R6PR-59X4...

@semic/testing (2.2.11), @vendure/dashboard (>=3.2.2, <=3.4.4) potentially affected by CVE-2026-63460 via @vendure/core (>=3.0.0, <=3.4.4)

@vendure/core NPM version =3.0.0, =3.2.2, =3.4.4 Source cves: CVE-2026-63460 Source advisory: OSV:GHSA-JGM3-QMP2-C4P7...

PT-2026-95051

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...

@semic/testing (2.2.11), @vendure/dashboard (>=3.2.2, <=3.4.4) potentially affected by CVE-2026-25050 via @vendure/core (>=3.0.0, <=3.4.4)

@vendure/core NPM version =3.0.0, =3.2.2, =3.4.4 Source cves: CVE-2026-25050 Source advisory: OSV:GHSA-6F65-4FV2-WWCH...

@semic/testing (2.2.11), @vendure/dashboard (>=3.2.2, <=3.4.4) potentially affected by CVE-2026-25050 via @vendure/core (>=3.0.0, <=3.4.4)

@vendure/core NPM version =3.0.0, =3.2.2, =3.4.4 Source cves: CVE-2026-25050 Source advisory: SNYK:JS-VENDURECORE-15166603...