CVEs for Shopify

Name: Rewindex CVE index
Creator: Rewindex
License: https://creativecommons.org/licenses/by/4.0/

6 matching vulnerabilities, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.

Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.

CVEs per week for Shopify, last 52 weeks

Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.

2026-08-07
CVE-2026-48122 Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension
CVSS 5.4 mediumEPSS 0.18%Shopify
2026-04-08
CVE-2026-39862 Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link
CVSS 8.8 highEPSS 0.55%Shopify
2026-03-31
CVE-2026-34060 Ruby LSP has arbitrary code execution through branch setting
CVSS 9.8 criticalEPSS 0.48%Shopify
2025-07-14
CVE-2025-53623 Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class
CVSS 8.1 highEPSS 0.83%Shopify
2025-05-21
CVE-2025-48069 ejson2env has insufficient input sanitization
CVSS 6.6 mediumEPSS 1.4%Shopify
2025-03-27
CVE-2025-30221 Pitchfork HTTP Request/Response Splitting vulnerability
CVSS 4.3 mediumEPSS 0.29%Shopify

Markdown JSON