EUVD-2026-79472

Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM component: Order Management. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps -...

EUVD-2026-79471

Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM component: Order Management. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps -...

CVE-2026-83144

CVE-2026-83144 affects the Order Management component of Oracle Siebel CRM – Siebel Apps Customer Order Management , versions 17.0 through 26.7 . A low-privileged attacker with network access via HTTP can exploit this vulnerability, though successful exploitation requires user interaction from a ...

CVE-2026-83145

Oracle Siebel CRM — Siebel Apps – Customer Order Management (Order Management component) in supported versions 17.0 through 26.7 is affected by a vulnerability that a low-privileged attacker with network access via HTTP can exploit with low complexity , though successful exploitation requires hum...

CVE-2026-83116

A vulnerability in Oracle Order Management (component: Product Diagnostic Tools ) within Oracle E-Business Suite , affecting supported versions 12.2.5 through 12.2.15 , allows a low-privileged attacker with network access via HTTP to compromise the product. The attack has a scope change , meaning...

EUVD-2026-79444

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite component: Product Diagnostic Tools. Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order...

EUVD-2026-79504

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action Concrete\Controller\Backend\Dashboard\SitemapUpdate using only the global accesssitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated...

CVE-2026-18425 IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action Concrete\Controller\Backend\Dashboard\SitemapUpdate using only the global accesssitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated...

CVE-2026-18425

Concrete CMS 9 (versions 9.0.0 through 9.5.2) contains an IDOR flaw in the dashboard sitemap reorder action (SitemapUpdate::updateDisplayOrder). The controller checks only the global access_sitemap task permission and omits any per-page edit permission check, allowing an authenticated user with s...

CVE-2026-18425 IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action Concrete\Controller\Backend\Dashboard\SitemapUpdate using only the global accesssitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated...

CVE-2026-82190

Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that...

CVE-2026-82189

Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-service against the order pipeline: mass-failing pending orders to disrupt revenue and force manual reprocessing, or flipping already-fulfille...

EUVD-2026-79295

Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that...

CVE-2026-82190 Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that...

CVE-2026-82190

J2Store (a Joomla e-commerce extension by j2commerce.com) contains a predictable/forgeable order access token vulnerability affecting versions 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7 . Anyone who obtains the site's Joomla secret can compute a valid access token for any order without having pla...

CVE-2026-82190 Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that...

EUVD-2026-79292

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-81922 "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-81922

Concrete CMS before 9.5.3 contains a missing authorization flaw in the sitemap Explore dashboard controller . The send_to_top and send_to_bottom reorder actions performed only a generic sitemap-access check before loading a page via the attacker-controlled cNodeID parameter and altering its displ...

CVE-2026-82189 Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-service against the order pipeline: mass-failing pending orders to disrupt revenue and force manual reprocessing, or flipping already-fulfille...