PT-2026-88813

An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service...

CVE-2026-53639

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

CVE-2026-53637

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale...

CVE-2026-53637

CVE-2026-53637 is an improper workflow enforcement vulnerability in Sylius (an open-source eCommerce framework on Symfony). The affected component is the cart FormComponent , a Symfony UX LiveComponent. When an order is completed while the cart page remains open, the stale component fails to dete...

EUVD-2026-74287

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale...

CVE-2026-53637 Sylius: Cart FormComponent allows modification or deletion of an already-completed order

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale...

CVE-2026-53637 Sylius: Cart FormComponent allows modification or deletion of an already-completed order

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale...

CVE-2026-53637 Sylius: Cart FormComponent allows modification or deletion of an already-completed order

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale...

CVE-2026-53638

Sylius (open-source eCommerce framework built on Symfony) is affected by an authorization bypass in the shop account API. The endpoint PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}—used by an authenticated customer to change the payment method of an unpaid order—fails to val...

CVE-2026-53639 Sylius: IDOR on Shop Payment Request API endpoints

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

EUVD-2026-74285

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

CVE-2026-53639

Sylius (Open Source eCommerce Framework on Symfony) versions 2.0.0 through before 2.0.18, 2.1.15, and 2.2.6 are affected by an IDOR on Shop Payment Request API endpoints. The GET/PUT /api/v2/shop/payment-requests/{hash} and POST /api/v2/shop/orders/{tokenValue}/payment-requests endpoints perform ...

CVE-2026-53639 Sylius: IDOR on Shop Payment Request API endpoints

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

CVE-2026-53639 Sylius: IDOR on Shop Payment Request API endpoints

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

Exploit for CVE-2026-19949

CVE-2026-19949 — Prueba de concepto documentada y reproducible...

CVE-2026-53637: Operation on a Resource after Expiration or Release

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale...

WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation vulnerability

Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event Solution versions = 4.1.22...

CVE-2026-86263

A vulnerability was detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ...

CVE-2026-86264

A flaw has been found in sfturing ssmpro up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Endpoint. This manipulation of the argument hospitalName/officesName/doctorName...

CVE-2026-86262

A security vulnerability has been detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation ...