Composer shopper/framework has 12 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-56825 | Shopper: Missing authorization on product removal actions in CollectionProducts component | high | 8.1 | <2.9.2 | 2.9.2 |
| CVE-2026-56827 | Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of | high | 8.1 | <2.9.2 | 2.9.2 |
| CVE-2026-56829 | Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component | high | 8.1 | <2.9.2 | 2.9.2 |
| CVE-2026-56831 | Shopper: Negative discount values accepted and propagated through order calculation pipeline | medium | 6.5 | <2.9.0 | 2.9.0 |
| CVE-2026-56830 | Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph) | medium | 6.5 | <2.9.2 | 2.9.2 |
| CVE-2026-47743 | Shopper: Multiple data integrity and disclosure issues in admin Livewire components | high | 8.7 | <2.8.0 | 2.8.0 |
| CVE-2026-56826 | Shopping privilege escalation through missing authorization in Settings components | medium | 5.4 | >=2.0.0 and <2.9.2 | 2.9.2 |
| CVE-2026-47744 | Shopper: Authorization bypass and RBAC privilege escalation in team settings | critical | 9.9 | <2.8.0 | 2.8.0 |
| CVE-2026-47740 | shopper/framework: Authorization bypass in multiple Livewire admin components | high | 8.1 | <2.8.0 | 2.8.0 |
| CVE-2026-47742 | Shopper: Missing authorization on Product admin Livewire sub-form components | medium | 6.5 | <2.8.0 | 2.8.0 |
| CVE-2026-47745 | Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables | medium | 6.5 | <2.8.0 | 2.8.0 |
| CVE-2026-56828 | Shopper: privilege escalation via improper Livewire admin component authorization | high | 8.8 | >=2.8.0 and <2.9.2 | 2.9.2 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked