https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-39851.htmlhttps://patchthecve.com/cve/CVE-2026-39851.htmlFri, 24 Jul 2026 21:10:00 +0000MEDIUM 4.3: Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the requestEmailChange() mutation was revealing the existence of user-provided email addresses in error messages. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.https://patchthecve.com/cve/CVE-2026-35407.htmlhttps://patchthecve.com/cve/CVE-2026-35407.htmlFri, 24 Jul 2026 21:10:00 +0000MEDIUM 6.5: Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given authenticathttps://patchthecve.com/cve/CVE-2026-35401.htmlhttps://patchthecve.com/cve/CVE-2026-35401.htmlFri, 24 Jul 2026 21:10:00 +0000HIGH 7.5: Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can include many GraphQL mutations or queries in a single API call using aliases or chaining multiple mutations, resulting in resource exhaustion. This vulnerability is fixed in 3.23.0ahttps://patchthecve.com/cve/CVE-2026-33756.htmlhttps://patchthecve.com/cve/CVE-2026-33756.htmlFri, 24 Jul 2026 22:10:00 +0000HIGH 7.5: Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthe