A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routes_agent.py of the component selfRegister API Endpoint. Such manipulation of the argument initial_balance leads to business logic errors. The attack may be launched remotely. This attack is characterized by high complexity. The

CVE-2026-82423 是开源电商项目 macrozheng mall（版本不超过 1.0.3）中存在的一处业务逻辑漏洞。该漏洞位于支付成功接口 /order/paySuccess 中，具体涉及未知函数对参数 orderId 的处理。攻击者可以通过远程方式构造请求，操纵 orderId 参数，从而绕过或干扰正常的支付流程工作流（enforcement of behavioral workflow），可能导致支付状态验证不严、订单状态被异常篡改或业务流程被非预期触发。CVSS 评分为 5.4 分（AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L），属于中危漏洞，利用条件为需要低权限账号，且无需用户交互。值得注意的是，厂商在收到漏洞报告后，未作解释直接删除了对应的 GitHub issue，这增加了漏洞信息不透明和修复不及时的风险。目前该漏洞尚未被列入已知被利用漏洞目录（KEV），也无明确证据表明已在野利用。受影响产品为 macrozheng mall 1.0.3 及之前版本。建议用户尽快关注官方发布的安全更新或补丁，在修复前对 /order/paySuccess 接口实施访问控制，并严格校验 orderId 参数，避免对非本人订单进行操作。

A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/update/quantity. The manipulation of the argument quantity leads to business logic errors. The attack may be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rma_qty/resolution_type/rma_reason_id results in enforcement of behavioral workflow. The attack may be performed from remote. The exploit is now public and may be used. The vendor confirms: "The reported issues were already identified

A vulnerability was identified in WonderTrader up to 0.9.9. Affected is the function _undone_qty in the library src/WtCore/TraderAdapter.h of the component Pending Order Handler. The manipulation of the argument getUndoneQty leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted e

A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulation of the argument FID_JYLB results in enforcement of behavioral workflow. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit is now public and

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update_lob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used f

Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

A flaw has been found in SourceCodester Simple Food Ordering System 1.0. The affected element is an unknown function of the file /cart.php. Executing a manipulation of the argument item_price can lead to business logic errors. The attack may be performed from remote. The exploit has been published and may be used.

Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability.

A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the file model/redemption.go of the component Redemption Code Top-Up Endpoint. The manipulation results in business logic errors. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The explo

Permission control vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Use-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in contacts. Impact: Successful exploitation of this vulnerability may affect availability.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with a read_api scoped OAuth application to create issues and add comments to issues in private projects due to improper authorization.