PatchTheCVEspreecommerce vulnerabilities
Recent CVEs affecting spreecommerce products. 5 tracked.
spreecommerce has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-02-06. Highest priority: CVE-2011-10019 (score 71/100).
- CVE-2011-10019 CRITICAL 9.8 UPGRADE Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functio
- CVE-2026-25758 HIGH 7.5 UPGRADE Spree is an open source e-commerce solution built with Ruby on Rails
- CVE-2026-25757 MEDIUM 5.3 UPGRADE Spree is an open source e-commerce solution built with Ruby on Rails
- CVE-2026-22588 MEDIUM 6.5 UPGRADE Spree is an open source e-commerce solution built with Ruby on Rails
- CVE-2011-10026 CRITICAL 9.8 UPGRADE Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search fu
FAQ
How do I fix spreecommerce vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is spreecommerce being exploited right now?
None of the tracked spreecommerce CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which spreecommerce CVE should I patch first?
CVE-2011-10019 currently ranks highest (71/100): Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functio.