58460 matches found
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
Summary The Shopware Store API endpoint /store-api/handle-payment contains an object-level authorization flaw that allows a low-privileged external user with a normal customer or guest context to trigger the payment flow for another user’s order by supplying a foreign orderId. The affected...
User Impersonation
Overview shopware/platform is a Shopware e-commerce core. Affected versions of this package are vulnerable to User Impersonation via the handle-payment endpoint. An attacker can trigger payment flows for orders belonging to other users by supplying a valid foreign orderId, potentially causing...
GHSA-VVGJ-X9JQ-8CJ9 vulnerabilities
Vulnerabilities for packages: rke2-runtime-fips, dkron, kubedock-fips, kube-metrics-adapter-fips, kubernetes-dns-node-cache, traefik, ipfs-cluster-fips, spegel, teleport, commercial-expanso-edge, kargo, opentelemetry-operator-fips, traefik-fips, eks-distro, k8sgateway-fips, rke2-runtime,...
MINI-798V-7QVM-3FVM
Bulletin has no description...
MINI-J2G6-GWC3-36JJ
Bulletin has no description...
MINI-53RR-RXGF-G8H7
Bulletin has no description...
GHSA-JH6H-V6MP-H22V milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery
A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kvcatalog.go of the component Grantee ID Hash Handler. The manipulation leads to use of weak hash. The attack needs to be performed locally. The...
MINI-698V-HX2W-7H3H
Bulletin has no description...
CVE-2026-43986
creationtimestamp| type| source ---|---|--- 2026-06-04 18:05:50+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mni7mj5dvi25 2026-06-04 23:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mniq3rzwzs22...
MINI-HP9H-R4VH-FX8V
Bulletin has no description...
MINI-RV8V-X5JG-5283
Bulletin has no description...
MINI-8QR3-8G6P-48MJ
Bulletin has no description...
MINI-Q6MV-FQGC-CJRV
Bulletin has no description...
MINI-J952-FQW8-FRC8
Bulletin has no description...
Use of Weak Hash
Overview Affected versions of this package are vulnerable to Use of Weak Hash via the grantee ID hashing logic. An attacker can make two different RBAC grantee records map to the same truncated identifier by creating or renaming roles and collections whose metadata is hashed into the 16-hex...
MINI-7J3P-3236-PGC9
Bulletin has no description...
MINI-Q92X-W4FC-9CWQ
Bulletin has no description...
MINI-6RMF-8V2V-GQG8
Bulletin has no description...