E-Commerce

saleor/saleor

Saleor Core: the high performance, composable, headless commerce API.

#python#store#commerce#shop#ecommerce#cart#graphql#headless#headless-commerce#multichannel#shopping-cart#composable#oms#pim#checkout#payments#order-management#e-commerce

スコア

/ 100

Star

22,901

Fork

6,023

Open Issue

186

サイズ

236MB

言語

Python ★

最終push

1 日前

Docker

🐳 Dockerfile ★

採点内訳

過去CVE 14件 (やや多い)

✓

直近 push: 1 日前

✓

得意言語 (Python)

✓

オープンissue 186件

✓

大規模 (236MB)

—

Docker 対応 (Dockerfile)

✓

10k–50k: 中級 (★22,901)

—

※ 各項目の重みは「採点ルール」を参照。合計は 0 で底打ち。

過去の SecurityAdvisory (14 件)

HIGHGHSA-24jw-f244-qfpp CVE-2026-337562026/4/8
Denial of Service via Unbounded GraphQL Query Batching
HIGHGHSA-gqqv-xwx3-jj4h CVE-2026-354012026/4/8
Resource exhaustion vulnerability in GraphQL queries
MEDIUMGHSA-hwph-9537-mc3p CVE-2026-354072026/4/8
Cross-Account Email Change via Unbound Confirmation Token
MEDIUMGHSA-m3rm-m4vq-27x7 CVE-2026-398512026/4/8
User enumeration vulnerability due to different error messages
HIGHGHSA-r6fj-f4r9-36gr CVE-2026-241362026/1/23
Insecure Direct Object Reference (IDOR) in GraphQL API
HIGHGHSA-666h-2p49-pg95 CVE-2026-234992026/1/21
Stored XSS via Unrestricted File Uploads
HIGHGHSA-8jcj-r5g2-qrpv CVE-2026-228492026/1/21
Lack of proper HTML sanitization in rich text fields
MEDIUMGHSA-8w67-mfm5-fwx5 CVE-2025-584422025/9/9
User enumeration vulnerability in Saleor due to different error messages
MEDIUMGHSA-ff69-fwjf-3c9w CVE-2024-312052024/4/8
CSRF bypass in refreshToken mutation
MEDIUMGHSA-mrj3-f2h4-7w45 CVE-2024-298882024/3/27
Customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method
MEDIUMGHSA-3rqj-9v87-2x3f CVE-2023-326942023/5/24
Non-constant time HMAC comparison in Adyen plugin
MEDIUMGHSA-r8qr-wwg3-2r85 CVE-2023-260512023/3/2
Staff-Authenticated Error Message Information Disclosure Vulnerability via Python Exceptions
LOWGHSA-3hvj-3cg9-v242 CVE-2023-260522023/3/2
Unauthenticated Information Disclosure Vulnerability via Python Exceptions
MEDIUMGHSA-xhq8-8c5v-w8ff CVE-2022-392752022/10/3
Improper object type validation in mutations leading to unauthorized access