CVE-2026-50986

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

CVE-2026-50986

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

PT-2026-66698

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying...

The vulnerability of the apply_patch() function in the cJSON_Utils.c component of the library for working with JSON objects in C language allows a attacker to compromise data integrity.

The vulnerability of the applypatch function in the cJSONUtils.c component of the C language JSON object handling library is related to an incorrect implementation of the sequence of actions to be performed. Exploiting this vulnerability could allow a remote attacker to compromise data integrity...

CVE-2026-68501

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

CVE-2026-68501 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

CVE-2026-68501 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

CVE-2026-68501

Sylius Mollie Plugin for Sylius is affected by an IDOR vulnerability prior to versions 2.2.8, 3.2.4, and 3.3.1. The GET endpoints /{_locale}/thank-you (PageRedirectController::thankYouAction) and /{_locale}/get-code (QrCodeAction::fetchQrCodeFromOrder) can look up sequential orderId values withou...

CVE-2026-68501

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

CVE-2026-68501 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

CVE-2026-68500 Sylius Mollie Plugin: Payment status forgery via the payment webhook

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /locale/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the...

CVE-2026-68500

The Sylius Mollie Plugin (affected: before versions 2.2.8, 3.2.4, 3.3.1) exposes a vulnerability in the POST /{_locale}/update-payment webhook. The webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment corresponds to the referenced Sylius order,...

SUSE CVE-2026-25773

UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitiz...

JLSEC-2026-915 In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled ...

In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packetsize is mishandled related to the rendering of all channels in an arbitrary order...

CVE-2026-57859 e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()

e107 prior to version 2.3.8 contains a code execution vulnerability in the earray deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the userprefs column. The earray::unserialize function in...

CVE-2026-57859

Summary of CVE-2026-57859 : In e107 prior to version 2.3.8, a code execution vulnerability exists in the e_array deserialization handler. The e_array::unserialize() function only checks for the prefix 'array' before passing the stored value to eval(), allowing an attacker with out-of-band databas...

CVE-2026-57859 e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()

e107 prior to version 2.3.8 contains a code execution vulnerability in the earray deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the userprefs column. The earray::unserialize function in...

BIT-SQLITE-2026-51304

sqlite 3.41 has a use-after-free UAF vulnerability in the ORDER BY clause parsing routine. The affected code first releases the memory of an ExprList object via sqlite3ExprListDelete, then attempts to access the nExpr member of the already freed object. This dangling pointer access causes invalid...

CVE-2026-44108

Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these...

CVE-2026-44108

CVE-2026-44108 describes a flaw in the shutdown script execution order that terminates the firewall during shutdown, creating a temporary window where internal services may become externally accessible. This could allow an unauthenticated remote attacker to connect to those services and potential...