Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:gem/spree_core@4.1.14
Typegem
Namespace
Namespree_core
Version4.1.14
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version4.10.2
Latest_non_vulnerable_version5.2.5
Affected_by_vulnerabilities
0
url VCID-1373-hmyc-sqbx
vulnerability_id VCID-1373-hmyc-sqbx
summary 
Spree API has Unauthenticated IDOR - Guest Address
An Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-22589
reference_id
reference_type
scores
0
value 0.00089
scoring_system epss
scoring_elements 0.25386
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-22589
1
reference_url https://github.com/spree/spree
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spree/spree
2
reference_url https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-12T17:32:40Z/
url https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795
3
reference_url https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-12T17:32:40Z/
url https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad
4
reference_url https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-12T17:32:40Z/
url https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67
5
reference_url https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-12T17:32:40Z/
url https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-22589
reference_id CVE-2026-22589
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-22589
7
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_core/CVE-2026-22589.yml
reference_id CVE-2026-22589.YML
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_core/CVE-2026-22589.yml
8
reference_url https://github.com/advisories/GHSA-3ghg-3787-w2xr
reference_id GHSA-3ghg-3787-w2xr
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-3ghg-3787-w2xr
9
reference_url https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr
reference_id GHSA-3ghg-3787-w2xr
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
3
value HIGH
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-12T17:32:40Z/
url https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr
fixed_packages
0
url pkg:gem/spree_core@4.10.2
purl pkg:gem/spree_core@4.10.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/spree_core@4.10.2
1
url pkg:gem/spree_core@5.0.7
purl pkg:gem/spree_core@5.0.7
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/spree_core@5.0.7
2
url pkg:gem/spree_core@5.1.0.beta
purl pkg:gem/spree_core@5.1.0.beta
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1373-hmyc-sqbx
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/spree_core@5.1.0.beta
3
url pkg:gem/spree_core@5.1.9
purl pkg:gem/spree_core@5.1.9
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/spree_core@5.1.9
4
url pkg:gem/spree_core@5.2.0.rc1
purl pkg:gem/spree_core@5.2.0.rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1373-hmyc-sqbx
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/spree_core@5.2.0.rc1
5
url pkg:gem/spree_core@5.2.5
purl pkg:gem/spree_core@5.2.5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/spree_core@5.2.5
aliases CVE-2026-22589, GHSA-3ghg-3787-w2xr
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1373-hmyc-sqbx
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:gem/spree_core@4.1.14