Composer shopware/storefront has 5 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-24747 | HTTP caching is marking private HTTP headers as public in Shopware | medium | 6.3 | <6.4.8.2 | 6.4.8.2 |
| CVE-2022-24746 | HTML injection possibility in voucher code form in Shopware | medium | 6.1 | <6.4.8.1 | 6.4.8.1 |
| CVE-2024-27917 | Shopware's session is persistent in Cache for 404 pages | high | 7.5 | >=6.5.8.0 and <6.5.8.7 | 6.5.8.7 |
| CVE-2022-24745 | Shopware guest session is shared between customers | medium | 4.8 | <6.4.8.2 | 6.4.8.2 |
| CVE-2025-67648 | Shopware Storefront Reflected XSS in Storefront Login Page | high | 7.1 | >=6.4.6.0 and <6.6.10.10 or >=6.7.0.0 and <6.7.5.1 | 6.6.10.10, 6.7.5.1 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked