CVE-2026-84836

HighCVSS 7.1/10Last modified Sep 3, 2026

Description

Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
kirillbdevWC Ukraine Shipping<= 1.22.3

References

Timeline

Published
Sep 3, 2026
Last modified
Sep 3, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-848377.8A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processeCVE-2026-848387.8A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs wCVE-2026-848395.3A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xmCVE-2026-84844.8A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl()" wrapper due to a lack of size verification for the argument array befCVE-2026-848406.5A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of theCVE-2026-848417.3A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results CVE-2026-848428.1IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticCVE-2026-848477.5Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.CVE-2026-848487.1Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.CVE-2026-848496.5Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.CVE-2026-84857.5Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit CVE-2026-848504.8Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 a
CVE-2026-84836: High severity, CVSS 7.1 | Vulnix