https://vulnerability.circl.lu/sightings/feed 2026-09-30T01:37:01.768119+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/f2c6b151-0057-4f93-ad81-1be3a4f0ea8b/export 2026-09-30T01:37:01.794467+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f2c6b151-0057-4f93-ad81-1be3a4f0ea8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100872", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwk2rfbhsr27", "content": "\ud83d\udfe0 CVE-2026-100872 - High (7.5)\n\nSylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculatio...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100872/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-28T00:31:10.773425Z"} 2026-09-28T00:31:10.773425+00:00 https://vulnerability.circl.lu/sighting/eb6a26c8-62e8-4987-80e0-2ee533d1675a/export 2026-09-30T01:37:01.795722+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "eb6a26c8-62e8-4987-80e0-2ee533d1675a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100872", "type": "seen", "source": "https://gist.github.com/ichintu/f423d36b58b96f0e6b3b72c29160f47e", "content": "On September 27, 2026, four HIGH-severity vulnerabilities were disclosed affecting Sylius e-commerce platforms (versions prior to 1.12.25/1.13.17/1.14.20 and 2.1.16/2.2.9). The flaws include:\n\u2022 **Payment Manipulation & Unauthorized Refunds** (CVE-2026-100872, CVE-2026-100869): Missing validation and API restrictions allow attackers to alter order totals or force refunds while bypassing gateway checks, leading to financial fraud.\n\u2022 **JWT Audience Confusion** (CVE-2026-100871): Malformed tokens from the Shop API can be misinterpreted by the Admin API, enabling privilege escalation to full administrative access.\n\u2022 **Host Header Poisoning** (CVE-2026-100870): Unvalidated `Host` headers allow attackers to forge admin password-reset links, facilitating account takeover.\n\n**Impact & Recommendation:** These vulnerabilities pose significant risks of financial loss and unauthorized administrative access. Users should immediately upgrade to the patched versions and apply vendor-recommended mitigations.", "creation_timestamp": "2026-09-27T16:00:35.000000Z"} 2026-09-27T16:00:35+00:00 https://vulnerability.circl.lu/sighting/bcc7598d-790c-489e-88f8-ff9d14cd381f/export 2026-09-30T01:37:01.795859+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "bcc7598d-790c-489e-88f8-ff9d14cd381f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100872", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fsopnd6va4p2l", "content": "CVE-2026-100872 - Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite\nCVE ID : CVE-2026-100872\n \n Published : Sept. 27, 2026, 1:16 p.m. | 1\u00a0hour, 12\u00a0minutes ago\n \n Description : Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalc...", "creation_timestamp": "2026-09-27T14:47:09.886081Z"} 2026-09-27T14:47:09.886081+00:00