https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-31000.htmlhttps://patchthecve.com/cve/CVE-2022-31000.htmlWed, 17 Jun 2026 04:44:34 +0000LOW 2.3: solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the executhttps://patchthecve.com/cve/CVE-2021-43846.htmlhttps://patchthecve.com/cve/CVE-2021-43846.htmlWed, 17 Jun 2026 04:11:33 +0000MEDIUM 5.3: `solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versiohttps://patchthecve.com/cve/CVE-2021-41274.htmlhttps://patchthecve.com/cve/CVE-2021-41274.htmlWed, 17 Jun 2026 04:08:13 +0000CRITICAL 9.3: solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_https://patchthecve.com/cve/CVE-2020-15109.htmlhttps://patchthecve.com/cve/CVE-2020-15109.htmlWed, 17 Jun 2026 02:56:04 +0000MEDIUM 5.3: In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipm