Loading story…
Two application-layer vulnerabilities were disclosed affecting monetr and Craft Commerce, exposing different classes of business risk. In CVE-2026-39901, monetr contains an authorization bypass and transaction-integrity flaw that lets a low-privileged user, with user interaction, selectively hide imported bank transactions. Although the records are only soft-deleted in the database, they disappear from application views and calculations, causing inaccurate balances and reports; the issue was scored CVSS v3.1 5.7 (Medium) and tied to inconsistent authorization checks across HTTP methods on the same resource.
In CVE-2026-32270, a flaw in the Craft Commerce payments controller can disclose customer personally identifiable information, including names, email addresses, shipping and billing addresses, and purchase histories, when an attacker can obtain a valid order number. The exposure is more practical where applications use predictable or sequential order identifiers, while high-entropy values such as UUIDv4 materially reduce exploitability; the issue was assigned CVSS 4.0 1.7, reflecting low attack complexity, no required privileges, and impact limited to confidentiality.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A vulnerability in the Craft Commerce Payments Controller was publicly documented as CVE-2026-32270. The issue can expose customer personal information such as names, email addresses, addresses, and purchase history when a valid order number is obtained.
A vulnerability affecting the monetr budgeting application was publicly documented as CVE-2026-39901. The flaw allows a low-privileged user, with user interaction, to hide imported bank transactions from application views and calculations, creating a transaction integrity issue.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have begun targeting **CVE-2026-71362**, a critical incorrect-authorization flaw in **Adobe Commerce**, **Adobe Commerce B2B**, and **Magento Open Source** that can let unauthenticated users hijack customer accounts. Sansec reported seeing exploitation attempts blocked by its Shield WAF and said patch analysis showed Magento mishandles customer identity within an account session, allowing a session to be switched to another customer account and exposing private customer data. Adobe included fixes for CVE-2026-71362 in its August 2026 security updates, with affected versions spanning multiple July 2026 and some August 2026 release lines before newer August builds. The same update also addressed **CVE-2026-48413**, a stored **XSS** issue, along with six additional Commerce and Commerce B2B vulnerabilities, four rated high severity. Administrators were urged to move to the latest supported `-p` release and apply Adobe’s isolated patches promptly to reduce the risk of account takeover and data exposure.
Aug 28, 2026
Craft CMS disclosed and patched two **critical** vulnerabilities, `CVE-2025-32432` and `CVE-2024-58136`, that can be chained or abused to achieve **unauthenticated remote code execution** and full compromise of vulnerable servers. The flaws affect Craft CMS `5.x` before `5.6.17`, `4.x` before `4.14.15`, and `3.x` before `3.9.15`; one issue involves insufficient input validation in image transformation functionality, while the other stems from unsafe handling of the `__class` variable in the underlying Yii 2 framework. Researchers and national defenders reported that the vulnerabilities are being **actively exploited in the wild**, with investigations tying attacks to malicious requests targeting the `actions/assets/generate-transform` endpoint and abuse of `__class` parameters. Organizations running exposed Craft CMS instances were urged to patch immediately, review logs for suspicious POST activity, check file and system integrity, and rotate credentials if compromise is suspected.
Aug 15, 2026
**Adobe Commerce** disclosed multiple **stored cross-site scripting (XSS)** vulnerabilities affecting versions `2.4.9-alpha3`, `2.4.8-p3`, `2.4.7-p8`, `2.4.6-p13`, `2.4.5-p15`, `2.4.4-p16`, and earlier. The issues tracked as `CVE-2026-21284`, `CVE-2026-21290`, `CVE-2026-21311`, and `CVE-2026-21361` allow malicious JavaScript to be injected into vulnerable form fields and later executed in a victim’s browser when the affected page is viewed. Adobe indicates the impact can include **session takeover** and high confidentiality and integrity risk. The vulnerabilities differ primarily in the privilege level required to plant the payload, with most requiring a **high-privileged attacker** and at least one (`CVE-2026-21290`) being exploitable by a **low-privileged attacker**. In all cases, exploitation requires **user interaction**, as a victim must browse to the page containing the injected content. A separate write-up about a chained exploit involving `postMessage` misconfiguration, prompt injection, and sandbox escape on an AI assistant platform does not describe the same Adobe Commerce disclosure and should be excluded.
Jun 29, 2026