These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-108724 is an authorization bypass vulnerability in Sylius, a popular e-commerce platform, affecting versions up to 2.3.0. The vulnerability allows unauthenticated attackers to read unmoderated and rejected product reviews via the Shop API Product-Review Endpoint. This could potentially expose sensitive information about products, including review titles, ratings, comments, timestamps, and author first names.
CVE-2026-100872 is a vulnerability in Sylius, a popular e-commerce platform, that allows unauthenticated attackers to modify order totals after gateway transaction initiation. This vulnerability affects Sylius versions before 2.1.16 and 2.2.9. Attackers can exploit this vulnerability by paying a small amount, enlarging the order after gateway capture, and having the system mark the inflated order as fully [truncated]
CVE-2026-100871 debrief based on the supplied source corpus. Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 are vulnerable due to JWT audience confusion. This allows attackers to register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access. Defenders should verify Syliu [truncated]
CVE-2026-100870 is a vulnerability in Sylius, a popular e-commerce platform, that allows unauthenticated attackers to redirect administrator password-reset tokens to attacker-controlled domains. This is achieved by exploiting the platform's use of the Host header in building password-reset links without proper validation. Attackers can request password resets for known administrator email addresses with f [truncated]
CVE-2026-100869 is a high-severity vulnerability in Sylius, a popular e-commerce platform, that allows attackers to trigger refunds on completed orders. This issue affects Sylius versions before 2.1.16 and 2.2.9. Attackers with order tokens can submit arbitrary payment actions, including refunds, via the Shop API endpoint, which can lead to financial loss. The vulnerability has a CVSS score of 8.2 and is [truncated]
An authorization bypass vulnerability exists in the Sylius shop account API, allowing an authenticated customer to change the payment method of an order to a globally enabled method, even if explicitly excluded from that channel. This issue can lead to unauthorized payment processing and potential financial losses. Defenders responsible for Sylius deployments should assess exposure and apply patches or co [truncated]
The Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to versions 2.2.8, 3.2.4, and 3.3.1, the plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints do not perform ownership or session checks when looking up sequential orderId values. This exposes order tokenValue values that c [truncated]
The Sylius Mollie Plugin, used for integrating Mollie payment gateway with Sylius applications, contains a vulnerability. Specifically, the POST /{_locale}/update-payment payment webhook does not verify that the Mollie payment belongs to the referenced Sylius order. This oversight allows an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring f [truncated]