- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 12 · 1 critical, 6 high, 5 medium
- Registry
- Packagist
Advisories 12
- CVE-2026-56828High 8.8
Shopper: read-only team permissions allow administrator creation and permission escalation
Affected: from 2.8.0, fixed in 2.9.2.
- CVE-2026-56826Medium 5.4
Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration
Affected: from 2.0.0, fixed in 2.9.2.
- CVE-2026-56830Medium 6.5
Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization
Affected: fixed in 2.9.2.
- CVE-2026-56831Medium 6.5
Shopper: Negative discount values accepted and propagated through order calculation pipeline
Affected: fixed in 2.9.0.
- CVE-2026-56827High 8.1
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility…
Affected: fixed in 2.9.2.
- CVE-2026-56829High 8.1
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
Affected: fixed in 2.9.2.
- CVE-2026-56825High 8.1
Shopper: Missing authorization on product removal actions in CollectionProducts component
Affected: fixed in 2.9.2.
- CVE-2026-47743High 8.7
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Affected: fixed in 2.8.0.
- CVE-2026-47740High 8.1
Shopper: Authorization bypass in multiple Livewire admin components
Affected: fixed in 2.8.0.
- CVE-2026-47742Medium 6.5
Shopper: Missing authorization on Product admin Livewire sub-form components
Affected: fixed in 2.8.0.
- CVE-2026-47744Critical 9.9
Shopper: Authorization bypass and RBAC privilege escalation in team settings
Affected: fixed in 2.8.0.
- CVE-2026-47745Medium 6.5
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Affected: fixed in 2.8.0.