CVE-2026-25050

Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the NativeAuthenticationStrategy.authenticate method is vulnerable to a timing attack that allows attackers to enumerate valid usernames email addresses. In packages/core/src/config/auth/native-authentication-strategy.t...

Vendure corporate platform Path Traversal DoS

The vulnerability of the Vendure corporate platform lies in improper cleaning of file paths and bypassing directories due to insufficient verification of input data. Exploitation of this vulnerability can allow a malicious actor to disclose protected information or cause service failures...