https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 22:27:41 +0000 https://vulnerability.circl.lu/sighting/9ceb6566-c730-4b3e-bc04-371dc54f2fc3/export {"uuid": "9ceb6566-c730-4b3e-bc04-371dc54f2fc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100870", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwki4m4lua2r", "content": "CVE-2026-100870 - sylius\nSylius builds password\u2011reset links for administrators using the website address sent by the browser, without checking it. An attacker can trick the system into sending those links to a domain\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sylius #CVE #infosec", "creation_timestamp": "2026-09-28T04:30:05.297117Z"} {"uuid": "9ceb6566-c730-4b3e-bc04-371dc54f2fc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100870", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwki4m4lua2r", "content": "CVE-2026-100870 - sylius\nSylius builds password\u2011reset links for administrators using the website address sent by the browser, without checking it. An attacker can trick the system into sending those links to a domain\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sylius #CVE #infosec", "creation_timestamp": "2026-09-28T04:30:05.297117Z"} https://vulnerability.circl.lu/sighting/9ceb6566-c730-4b3e-bc04-371dc54f2fc3/export Mon, 28 Sep 2026 04:30:05 +0000 https://vulnerability.circl.lu/sighting/71e9217d-eb2d-4143-9855-4134901304e6/export {"uuid": "71e9217d-eb2d-4143-9855-4134901304e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100870", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwk2qwu7ho2k", "content": "\ud83d\udfe0 CVE-2026-100870 - High (8.8)\n\nSylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100870/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-28T00:30:56.307623Z"} {"uuid": "71e9217d-eb2d-4143-9855-4134901304e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100870", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwk2qwu7ho2k", "content": "\ud83d\udfe0 CVE-2026-100870 - High (8.8)\n\nSylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100870/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-28T00:30:56.307623Z"} https://vulnerability.circl.lu/sighting/71e9217d-eb2d-4143-9855-4134901304e6/export Mon, 28 Sep 2026 00:30:56 +0000 https://vulnerability.circl.lu/sighting/32218b64-ecf4-4ada-b3c2-04191946bfc6/export {"uuid": "32218b64-ecf4-4ada-b3c2-04191946bfc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100870", "type": "seen", "source": "https://gist.github.com/ichintu/f423d36b58b96f0e6b3b72c29160f47e", "content": "On September 27, 2026, four HIGH-severity vulnerabilities were disclosed affecting Sylius e-commerce platforms (versions prior to 1.12.25/1.13.17/1.14.20 and 2.1.16/2.2.9). The flaws include:\n\u2022 **Payment Manipulation & Unauthorized Refunds** (CVE-2026-100872, CVE-2026-100869): Missing validation and API restrictions allow attackers to alter order totals or force refunds while bypassing gateway checks, leading to financial fraud.\n\u2022 **JWT Audience Confusion** (CVE-2026-100871): Malformed tokens from the Shop API can be misinterpreted by the Admin API, enabling privilege escalation to full administrative access.\n\u2022 **Host Header Poisoning** (CVE-2026-100870): Unvalidated `Host` headers allow attackers to forge admin password-reset links, facilitating account takeover.\n\n**Impact & Recommendation:** These vulnerabilities pose significant risks of financial loss and unauthorized administrative access. Users should immediately upgrade to the patched versions and apply vendor-recommended mitigations.", "creation_timestamp": "2026-09-27T16:00:35.000000Z"} {"uuid": "32218b64-ecf4-4ada-b3c2-04191946bfc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100870", "type": "seen", "source": "https://gist.github.com/ichintu/f423d36b58b96f0e6b3b72c29160f47e", "content": "On September 27, 2026, four HIGH-severity vulnerabilities were disclosed affecting Sylius e-commerce platforms (versions prior to 1.12.25/1.13.17/1.14.20 and 2.1.16/2.2.9). The flaws include:\n\u2022 **Payment Manipulation & Unauthorized Refunds** (CVE-2026-100872, CVE-2026-100869): Missing validation and API restrictions allow attackers to alter order totals or force refunds while bypassing gateway checks, leading to financial fraud.\n\u2022 **JWT Audience Confusion** (CVE-2026-100871): Malformed tokens from the Shop API can be misinterpreted by the Admin API, enabling privilege escalation to full administrative access.\n\u2022 **Host Header Poisoning** (CVE-2026-100870): Unvalidated `Host` headers allow attackers to forge admin password-reset links, facilitating account takeover.\n\n**Impact & Recommendation:** These vulnerabilities pose significant risks of financial loss and unauthorized administrative access. Users should immediately upgrade to the patched versions and apply vendor-recommended mitigations.", "creation_timestamp": "2026-09-27T16:00:35.000000Z"} https://vulnerability.circl.lu/sighting/32218b64-ecf4-4ada-b3c2-04191946bfc6/export Sun, 27 Sep 2026 16:00:35 +0000 https://vulnerability.circl.lu/sighting/0f3b7e17-6fd5-4cbc-80f9-41df43d885f9/export {"uuid": "0f3b7e17-6fd5-4cbc-80f9-41df43d885f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100870", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/jesnkemshe52w", "content": "CVE-2026-100870 - Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header\nCVE ID : CVE-2026-100870\n \n Published : Sept. 27, 2026, 1:16 p.m. | 1\u00a0hour, 12\u00a0minutes ago\n \n Description : Sylius versions before 1.12.25, 1.13.17, 1.14...", "creation_timestamp": "2026-09-27T14:59:09.711207Z"} {"uuid": "0f3b7e17-6fd5-4cbc-80f9-41df43d885f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100870", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/jesnkemshe52w", "content": "CVE-2026-100870 - Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header\nCVE ID : CVE-2026-100870\n \n Published : Sept. 27, 2026, 1:16 p.m. | 1\u00a0hour, 12\u00a0minutes ago\n \n Description : Sylius versions before 1.12.25, 1.13.17, 1.14...", "creation_timestamp": "2026-09-27T14:59:09.711207Z"} https://vulnerability.circl.lu/sighting/0f3b7e17-6fd5-4cbc-80f9-41df43d885f9/export Sun, 27 Sep 2026 14:59:09 +0000