https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-25757.htmlhttps://patchthecve.com/cve/CVE-2026-25757.htmlWed, 17 Jun 2026 10:25:10 +0000MEDIUM 5.3: Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This isshttps://patchthecve.com/cve/CVE-2026-25758.htmlhttps://patchthecve.com/cve/CVE-2026-25758.htmlWed, 17 Jun 2026 10:25:10 +0000HIGH 7.5: Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to othttps://patchthecve.com/cve/CVE-2026-22588.htmlhttps://patchthecve.com/cve/CVE-2026-22588.htmlWed, 17 Jun 2026 10:20:07 +0000MEDIUM 6.5: Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying ahttps://patchthecve.com/cve/CVE-2011-10026.htmlhttps://patchthecve.com/cve/CVE-2011-10026.htmlTue, 16 Jun 2026 23:28:29 +0000CRITICAL 9.8: Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamically invoked using Ruby’s send method. Thihttps://patchthecve.com/cve/CVE-2011-10019.htmlhttps://patchthecve.com/cve/CVE-2011-10019.htmlThu, 08 Oct 2026 16:16:41 +0000CRITICAL 9.8: Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbi