Skip to content
Noroxi

Shopify records

21 published records for vendor shopify.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
100%
Median publish → KEV
No record has entered KEV

Records by year

  1. 20
  2. 22
  3. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

21 records
  • CVE-2025-61686
    41Plan

    React Router has Path Traversal in File Session Storage

    CriticalCVSS 9.1Proof of conceptEPSS 17%

    shopify · react-router\/nodeJan 9, 2026

  • CVE-2026-55685
    34Monitor

    React Router: Unauthenticated Denial of Service via Inefficient Route Matching

    HighCVSS 8.7No exploitEPSS 1%

    shopify · react-routerJul 27, 2026

  • CVE-2026-42211
    32Monitor

    React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

    HighCVSS 8.1No exploitEPSS 1%

    shopify · react-routerJun 2, 2026

  • CVE-2026-21884
    32Monitor

    React Router SSR XSS in ScrollRestoration

    HighCVSS 8.2No exploitEPSS 1%

    shopify · react-routerJan 9, 2026

  • CVE-2025-59057
    30Monitor

    React Router has XSS Vulnerability

    HighCVSS 7.6Proof of conceptEPSS 1%

    shopify · react-routerJan 9, 2026

  • CVE-2026-42342
    30Monitor

    React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

    HighCVSS 7.5No exploitEPSS 0%

    shopify · react-routerJun 2, 2026

  • CVE-2026-34077
    30Monitor

    React Router vulnerable to Denial of Service via reflected user input in single-fetch

    HighCVSS 7.5No exploitEPSS 0%

    shopify · react-routerJun 2, 2026

  • CVE-2026-34060
    28Monitor

    Ruby LSP has arbitrary code execution through branch setting

    HighCVSS 7.1No exploitEPSS 1%

    shopify · ruby lspMar 30, 2026

  • CVE-2026-53668
    27Monitor

    React Router: Open redirect can lead to XSS

    MediumCVSS 6.9No exploitEPSS 0%

    shopify · react-routerJul 27, 2026

  • CVE-2025-68470
    26Monitor

    React Router has unexpected external redirect via untrusted paths

    MediumCVSS 6.5No exploitEPSS 0%

    shopify · react-routerJan 9, 2026

  • CVE-2026-40181
    26Monitor

    React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

    MediumCVSS 6.6No exploitEPSS 0%

    shopify · react-routerJun 2, 2026

  • CVE-2026-22030
    26Monitor

    React Router has CSRF issue in Action/Server Action Request Processing

    MediumCVSS 6.5No exploitEPSS 0%

    shopify · react-routerJan 9, 2026

  • CVE-2026-39862
    25Monitor

    Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link

    MediumCVSS 6.3No exploitEPSS 1%

    shopify · tophatApr 8, 2026

  • CVE-2020-8176
    24Monitor

    A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop

    MediumCVSS 6.1No exploitEPSS 1%

    shopify · koa-shopify-authJul 2, 2020

  • CVE-2026-22029
    24Monitor

    React Router vulnerable to XSS via Open Redirects

    MediumCVSS 6.1No exploitEPSS 1%

    shopify · remix-run\/reactJan 9, 2026

  • CVE-2026-53666
    24Monitor

    React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

    MediumCVSS 6.1No exploitEPSS 0%

    shopify · react-routerJul 27, 2026

  • CVE-2026-53667
    24Monitor

    React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)

    MediumCVSS 6.1No exploitEPSS 0%

    shopify · react-routerJul 27, 2026

  • CVE-2022-29230
    21Monitor

    Potential cross-site scripting (XSS) vulnerability in Hydrogen

    MediumCVSS 5.4No exploitEPSS 1%

    shopify · hydrogenMay 18, 2022

  • CVE-2026-33244
    21Monitor

    React Router has stored XSS via unescaped Location header in prerendered redirect HTML

    MediumCVSS 5.4No exploitEPSS 0%

    shopify · react-routerJun 2, 2026

  • CVE-2026-53669
    20Monitor

    React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

    MediumCVSS 5.1No exploitEPSS 0%

    shopify · react-routerJul 27, 2026

  • CVE-2026-33245
    18Monitor

    React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

    MediumCVSS 4.7No exploitEPSS 0%

    shopify · react-routerJun 2, 2026