shopware/core (packagist) has 55 known vulnerabilities, the worst rated CRITICAL. Upgrade to 6.7.10.1 or later to clear all of them. No malicious-package signal is recorded.
CyberXYZ does not call a package safe in absolute terms. It records 55 known vulnerabilities for shopware/core (packagist), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does shopware/core have known vulnerabilities?
Yes. CyberXYZ records 55 known vulnerabilities for shopware/core (packagist), the worst rated CRITICAL. These include GHSA-qmp9-2xwj-m6m9, GHSA-93cw-f5jj-x85w, GHSA-r64m-qchj-hrjp, GHSA-88rc-3p98-rgvx, GHSA-qg7c-q3vq-rgxr.
Which version of shopware/core should I use?
6.7.10.1 or later clears every advisory recorded for shopware/core (packagist). Check the release you pick before installing it.
How do I check shopware/core before installing?
Search shopware/core in CyberXYZ Check at https://cyberxyz.io/check?q=shopware%2Fcore. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 11:07 UTC. The most recent advisory here was published 2026-06-04. Updated continuously from NVD, GHSA, OSV and CNA feeds.