https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T20:40:15.789905+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-29888 CVE-2024-29888 — Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method 2026-10-07T20:40:15.791819+00:00

Affected: saleor

Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address. This issue has been patched in versions: `3.14.61`, `3.15.37`, `3.16.34`, `3.17.32`, `3.18.28`, `3.19.15`.

 https://cve.radiocsirt.org/vuln/ghsa-mrj3-f2h4-7w45 GHSA-mrj3-f2h4-7w45 — Saleor: Customers' addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method 2026-10-07T20:40:15.791890+00:00

Affected: PyPI: saleor

### Summary Using `Pickup: Local stock only` as a click-and-collect points could cause a leak of customer addresses

### Details When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address.

### Impact The vulnerability can cause the leak of customer's address when using click-and-collect delivery option marked as `Local stock only`. It has impact on all orders with click-and-collect delivery method marked as `Pickup:Local stock only` The affected versions: `>=3.14.56 <3.14.61`, `>=3.15.31 <3.15.37`, `>=3.16.27 <3.16.34`, `>=3.17.25 <3.17.32`, `>=3.18.19 <3.18.28`, `>=3.19.5 <3.19.15` This issue has been patched in versions: `3.14.61`, `3.15.37`, `3.16.34`, `3.17.32`, `3.18.28`, `3.19.15`

### Workaround We strongly recommend upgrading to the latest versions, in case of inability to upgrade straight away, possible workarounds are: - turn off click-and-collect delivery method on warehouse view when `Pickup` option is set to `Local stock only`. - cherry-pick the changes from PRs: https://github.com/saleor/saleor/pull/15694 & https://github.com/saleor/saleor/pull/15697

### References - Commits introducing the issue (https://github.com/saleor/saleor/commit/22a1aa3ef0bc54156405f69146788016a7f3f761 main, https://github.com/saleor/saleor/commit/997f7ea4f576543ec88679a86bfe1b14f7f2ff26 3.14, https://github.com/saleor/saleor…