{"vulnerability": "CVE-2026-53965", "sightings": [{"uuid": "e3db15f8-ba7c-4e04-bc42-7a98f2d697ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53965", "type": "seen", "source": "https://gist.github.com/FR-Flo/0e7f5508a7e506b113c6aa2e60563426", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Trello**\n    - [Attributs required par cat\u00e9gorie](https://trello.com/c/2loCszpt/1854-attributs-required-par-cat%C3%A9gorie) **\ud83e\udd73Testing**\n        - *Feat: Makes attributes required or not per categories* [\\#7474](https://github.com/Wishibam/Marketplace-api/pull/7474)\n    - [\ud83d\udfe2 Int\u00e9gration des fanions promotionnels \u2014 Ajout image au tag de taxon (MP) (\u00e9volution n\u00b011)](https://trello.com/c/fNNkiR1c/2405-%F0%9F%9F%A2-int%C3%A9gration-des-fanions-promotionnels-ajout-image-au-tag-de-taxon-mp-%C3%A9volution-n11) **\ud83e\udd75 Retour de test**\n        - *:sparkles: feat: fanions de taxon \u2014 images desktop/mobile (MP-api)* [\\#7617](https://github.com/Wishibam/Marketplace-api/pull/7617)\n    - [MP - Cr\u00e9ation / modification m\u00e9thode de livraison - impossible de save](https://trello.com/c/Ud1DRxgj/2407-mp-cr%C3%A9ation-modification-m%C3%A9thode-de-livraison-impossible-de-save) **\ud83e\udd75 Retour de test**\n        - *:bug: MP Fix Dpd class, file and discriminator name* [\\#7757](https://github.com/Wishibam/Marketplace-api/pull/7757)\n    - [Ticket de caisse - pb de cache](https://trello.com/c/EwgktbXZ/2493-ticket-de-caisse-pb-de-cache) **\ud83e\udd73Testing**\n        - *:bug: fix: reset receipt cache between export Messenger messages* [\\#7791](https://github.com/Wishibam/Marketplace-api/pull/7791)\n    - [\ud83d\ude84 Commande exp\u00e9di\u00e9e : l'interface part trop vite et garde l'ancien statut](https://trello.com/c/6QmFnpyb/2418-%F0%9F%9A%84-commande-exp%C3%A9di%C3%A9e-linterface-part-trop-vite-et-garde-lancien-statut) **\ud83e\udd75 Retour de test**\n        - *:sparkles: OMS order, add \"inProcessing\" flag* [\\#7797](https://github.com/Wishibam/Marketplace-api/pull/7797)\n    - [MP - Sur le marchand (listing & d\u00e9tails), mettre un lien qui redirige directement vers le marchand en front](https://trello.com/c/Z136lbnm/1296-mp-sur-le-marchand-listing-d%C3%A9tails-mettre-un-lien-qui-redirige-directement-vers-le-marchand-en-front) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n        - *:sparkles: Add retailer eshop link* [\\#7822](https://github.com/Wishibam/Marketplace-api/pull/7822)\n    - [Tag - Ajout du champ \"Visibilit\u00e9\" c\u00f4t\u00e9 MP](https://trello.com/c/zPFP31T9/2398-tag-ajout-du-champ-visibilit%C3%A9-c%C3%B4t%C3%A9-mp) **\ud83e\udd73Testing**\n        - *:sparkles: Add tag visibility field to retailer corner and category* [\\#7831](https://github.com/Wishibam/Marketplace-api/pull/7831)\n \n- **Misc**\n    - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n    - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n    - *:bug: WMS Log Message Container identifier* [\\#7810](https://github.com/Wishibam/Marketplace-api/pull/7810)\n    - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n    - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n    - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n    - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n    - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n    - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n    - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n    - *Merge feat/mcp-walking-skeleton (simulate #7823 merge)* [\\#7832](https://github.com/Wishibam/Marketplace-api/pull/7832)\n    - *feat(product-list): pipeline batch pour les actions de masse des listes produits* [\\#7833](https://github.com/Wishibam/Marketplace-api/pull/7833)\n    - *feat(mcp): Add OAuth discovery* [\\#7834](https://github.com/Wishibam/Marketplace-api/pull/7834)\n    - *:arrow\\_up: deps: bump mcp/sdk to 0.7.1 (CVE-2026-53965)* [\\#7838](https://github.com/Wishibam/Marketplace-api/pull/7838)\n    - *:bug: fix: guard against null option name/value in CSV export* [\\#7841](https://github.com/Wishibam/Marketplace-api/pull/7841)\n    - *:bug: fix: stream line item CSV export to fix memory exhaustion* [\\#7842](https://github.com/Wishibam/Marketplace-api/pull/7842)\n    - *:arrow\\_up: deps: patch sodium\\_compat Ed25519 key validation vulnerability* [\\#7843](https://github.com/Wishibam/Marketplace-api/pull/7843)\n \n- **D\u00e9j\u00e0 en production**\n    - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n    - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n    - *:bug: fix: stop gating unmapped counters on product validity* [\\#7835](https://github.com/Wishibam/Marketplace-api/pull/7835)\n    - *:bug: fix: repair missing-mapping counters behind the retailer list icon* [\\#7837](https://github.com/Wishibam/Marketplace-api/pull/7837)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n  curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n  curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n  V\u00e9rifier :\n  curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n  curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n\n### [PR #7828](https://github.com/Wishibam/Marketplace-api/pull/7828) \u2014 feat(merchandising): actions de masse asynchrones avec lock par organisation\n\n - ansible en prod \u00e7a https://github.com/Wishibam/Infrastructure/pull/467\n", "creation_timestamp": "2026-08-19T13:18:57.865970Z"}, {"uuid": "959d23a0-fc2a-42bd-a18e-fca71e8a699d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53965", "type": "seen", "source": "https://gist.github.com/FR-Flo/a82f37135301a238c85c6769b4acc044", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Trello**\n    - [\ud83d\udfe2 Int\u00e9gration des fanions promotionnels \u2014 Ajout image au tag de taxon (MP) (\u00e9volution n\u00b011)](https://trello.com/c/fNNkiR1c/2405-%F0%9F%9F%A2-int%C3%A9gration-des-fanions-promotionnels-ajout-image-au-tag-de-taxon-mp-%C3%A9volution-n11) **\ud83e\udd75 Retour de test**\n        - *:sparkles: feat: fanions de taxon \u2014 images desktop/mobile (MP-api)* [\\#7617](https://github.com/Wishibam/Marketplace-api/pull/7617)\n    - [MP - Cr\u00e9ation / modification m\u00e9thode de livraison - impossible de save](https://trello.com/c/Ud1DRxgj/2407-mp-cr%C3%A9ation-modification-m%C3%A9thode-de-livraison-impossible-de-save) **\ud83e\udd75 Retour de test**\n        - *:bug: MP Fix Dpd class, file and discriminator name* [\\#7757](https://github.com/Wishibam/Marketplace-api/pull/7757)\n    - [\ud83d\ude84 Commande exp\u00e9di\u00e9e : l'interface part trop vite et garde l'ancien statut](https://trello.com/c/6QmFnpyb/2418-%F0%9F%9A%84-commande-exp%C3%A9di%C3%A9e-linterface-part-trop-vite-et-garde-lancien-statut) **\ud83e\udd75 Retour de test**\n        - *:sparkles: OMS order, add \"inProcessing\" flag* [\\#7797](https://github.com/Wishibam/Marketplace-api/pull/7797)\n    - [MP - Sur le marchand (listing & d\u00e9tails), mettre un lien qui redirige directement vers le marchand en front](https://trello.com/c/Z136lbnm/1296-mp-sur-le-marchand-listing-d%C3%A9tails-mettre-un-lien-qui-redirige-directement-vers-le-marchand-en-front) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n        - *:sparkles: Add retailer eshop link* [\\#7822](https://github.com/Wishibam/Marketplace-api/pull/7822)\n    - [Tag - Ajout du champ \"Visibilit\u00e9\" c\u00f4t\u00e9 MP](https://trello.com/c/zPFP31T9/2398-tag-ajout-du-champ-visibilit%C3%A9-c%C3%B4t%C3%A9-mp) **\u2600\ufe0fIn review**\n        - *:sparkles: Add tag visibility field to retailer corner and category* [\\#7831](https://github.com/Wishibam/Marketplace-api/pull/7831)\n \n- **Misc**\n    - *:bug: fix: reset receipt cache between export Messenger messages* [\\#7791](https://github.com/Wishibam/Marketplace-api/pull/7791)\n    - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n    - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n    - *:bug: WMS Log Message Container identifier* [\\#7810](https://github.com/Wishibam/Marketplace-api/pull/7810)\n    - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n    - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n    - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n    - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n    - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n    - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n    - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n    - *Merge feat/mcp-walking-skeleton (simulate #7823 merge)* [\\#7832](https://github.com/Wishibam/Marketplace-api/pull/7832)\n    - *feat(product-list): pipeline batch pour les actions de masse des listes produits* [\\#7833](https://github.com/Wishibam/Marketplace-api/pull/7833)\n    - *feat(mcp): Add OAuth discovery* [\\#7834](https://github.com/Wishibam/Marketplace-api/pull/7834)\n    - *:arrow\\_up: deps: bump mcp/sdk to 0.7.1 (CVE-2026-53965)* [\\#7838](https://github.com/Wishibam/Marketplace-api/pull/7838)\n    - *:bug: fix: guard against null option name/value in CSV export* [\\#7841](https://github.com/Wishibam/Marketplace-api/pull/7841)\n \n- **D\u00e9j\u00e0 en production**\n    - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n    - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n    - *:bug: fix: stop gating unmapped counters on product validity* [\\#7835](https://github.com/Wishibam/Marketplace-api/pull/7835)\n    - *:bug: fix: repair missing-mapping counters behind the retailer list icon* [\\#7837](https://github.com/Wishibam/Marketplace-api/pull/7837)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n  curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n  curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n  V\u00e9rifier :\n  curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n  curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n\n### [PR #7828](https://github.com/Wishibam/Marketplace-api/pull/7828) \u2014 feat(merchandising): actions de masse asynchrones avec lock par organisation\n\n - ansible en prod \u00e7a https://github.com/Wishibam/Infrastructure/pull/467\n", "creation_timestamp": "2026-08-19T08:01:24.232399Z"}, {"uuid": "c036ccc5-0096-4fb4-a1f1-7145fb6e4809", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53965", "type": "seen", "source": "https://gist.github.com/FR-Flo/a3cc74f208df80c1d7f4b5b3e98e4f77", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Trello**\n    - [Attributs required par cat\u00e9gorie](https://trello.com/c/2loCszpt/1854-attributs-required-par-cat%C3%A9gorie) **\u2600\ufe0fIn review**\n        - *Feat: Makes attributes required or not per categories* [\\#7474](https://github.com/Wishibam/Marketplace-api/pull/7474)\n    - [\ud83d\udfe2 Int\u00e9gration des fanions promotionnels \u2014 Ajout image au tag de taxon (MP) (\u00e9volution n\u00b011)](https://trello.com/c/fNNkiR1c/2405-%F0%9F%9F%A2-int%C3%A9gration-des-fanions-promotionnels-ajout-image-au-tag-de-taxon-mp-%C3%A9volution-n11) **\ud83e\udd75 Retour de test**\n        - *:sparkles: feat: fanions de taxon \u2014 images desktop/mobile (MP-api)* [\\#7617](https://github.com/Wishibam/Marketplace-api/pull/7617)\n    - [MP - Cr\u00e9ation / modification m\u00e9thode de livraison - impossible de save](https://trello.com/c/Ud1DRxgj/2407-mp-cr%C3%A9ation-modification-m%C3%A9thode-de-livraison-impossible-de-save) **\ud83e\udd75 Retour de test**\n        - *:bug: MP Fix Dpd class, file and discriminator name* [\\#7757](https://github.com/Wishibam/Marketplace-api/pull/7757)\n    - [\ud83d\ude84 Commande exp\u00e9di\u00e9e : l'interface part trop vite et garde l'ancien statut](https://trello.com/c/6QmFnpyb/2418-%F0%9F%9A%84-commande-exp%C3%A9di%C3%A9e-linterface-part-trop-vite-et-garde-lancien-statut) **\ud83e\udd75 Retour de test**\n        - *:sparkles: OMS order, add \"inProcessing\" flag* [\\#7797](https://github.com/Wishibam/Marketplace-api/pull/7797)\n    - [MP - Sur le marchand (listing & d\u00e9tails), mettre un lien qui redirige directement vers le marchand en front](https://trello.com/c/Z136lbnm/1296-mp-sur-le-marchand-listing-d%C3%A9tails-mettre-un-lien-qui-redirige-directement-vers-le-marchand-en-front) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n        - *:sparkles: Add retailer eshop link* [\\#7822](https://github.com/Wishibam/Marketplace-api/pull/7822)\n    - [Tag - Ajout du champ \"Visibilit\u00e9\" c\u00f4t\u00e9 MP](https://trello.com/c/zPFP31T9/2398-tag-ajout-du-champ-visibilit%C3%A9-c%C3%B4t%C3%A9-mp) **\u2600\ufe0fIn review**\n        - *:sparkles: Add tag visibility field to retailer corner and category* [\\#7831](https://github.com/Wishibam/Marketplace-api/pull/7831)\n \n- **Misc**\n    - *:bug: fix: reset receipt cache between export Messenger messages* [\\#7791](https://github.com/Wishibam/Marketplace-api/pull/7791)\n    - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n    - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n    - *:bug: WMS Log Message Container identifier* [\\#7810](https://github.com/Wishibam/Marketplace-api/pull/7810)\n    - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n    - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n    - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n    - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n    - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n    - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n    - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n    - *Merge feat/mcp-walking-skeleton (simulate #7823 merge)* [\\#7832](https://github.com/Wishibam/Marketplace-api/pull/7832)\n    - *feat(product-list): pipeline batch pour les actions de masse des listes produits* [\\#7833](https://github.com/Wishibam/Marketplace-api/pull/7833)\n    - *feat(mcp): Add OAuth discovery* [\\#7834](https://github.com/Wishibam/Marketplace-api/pull/7834)\n    - *:arrow\\_up: deps: bump mcp/sdk to 0.7.1 (CVE-2026-53965)* [\\#7838](https://github.com/Wishibam/Marketplace-api/pull/7838)\n    - *:bug: fix: guard against null option name/value in CSV export* [\\#7841](https://github.com/Wishibam/Marketplace-api/pull/7841)\n \n- **D\u00e9j\u00e0 en production**\n    - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n    - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n    - *:bug: fix: stop gating unmapped counters on product validity* [\\#7835](https://github.com/Wishibam/Marketplace-api/pull/7835)\n    - *:bug: fix: repair missing-mapping counters behind the retailer list icon* [\\#7837](https://github.com/Wishibam/Marketplace-api/pull/7837)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n  curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n  curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n  V\u00e9rifier :\n  curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n  curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n\n### [PR #7828](https://github.com/Wishibam/Marketplace-api/pull/7828) \u2014 feat(merchandising): actions de masse asynchrones avec lock par organisation\n\n - ansible en prod \u00e7a https://github.com/Wishibam/Infrastructure/pull/467\n", "creation_timestamp": "2026-08-19T08:25:35.054901Z"}]}