Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Sylius 2.1.16, 2.2.9 Clear all filters
TI-2026-65010 CVE-2026-100872 · GHSA-2hp7-mfr2-4fg8

Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite

Priority HIGH 77

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00219 Published 2026-09-27 Fixed in 2.1.16, 2.2.9 CWE-345
TI-2026-65007 CVE-2026-100869 · GHSA-3jc5-2834-w7f2

Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API

Priority LOW 35

Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00263 Published 2026-09-27 Fixed in 2.1.16, 2.2.9 CWE-863