Security feed

25 October 2026

High

Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries

Type: advisorySource: Official CVE List25 Oct 2026, 14:05 UTC

Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of an…

Products: Ecommerce TemplateCVEs: CVE-2026-115453

High

Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier

Type: advisorySource: Official CVE List25 Oct 2026, 14:05 UTC

External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one p…

Products: Ecommerce TemplateCVEs: CVE-2026-115450

24 October 2026

Medium

Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service

Type: advisorySource: Official CVE List24 Oct 2026, 21:32 UTC

Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remot…

Products: Ecommerce TemplateCVEs: CVE-2026-91154