PT-2026-60764

Name of the Vulnerable Software and Affected Versions HCL Aftermarket EPC affected versions not specified Description The web server has the HTTP OPTIONS method enabled. This method allows an attacker to retrieve a list of supported HTTP methods, which can be used to gather information about the...

GHSA-6955-HRM5-C4QP Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

Impact An authorization bypass vulnerability exists in the shop account API. The PATCH /api/v2/shop/account/orders/tokenValue/payments/paymentId endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid state STATENEW, does not...