CVE-2026-84849

MediumCVSS 6.5/10Last modified Sep 3, 2026

Description

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published
Sep 3, 2026
Last modified
Sep 3, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-84857.5Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit CVE-2026-848504.8Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 aCVE-2026-848517.5An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion daCVE-2026-848524.4A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNewCVE-2026-848547.0In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer couCVE-2026-848565.3A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file appsCVE-2026-848575.3A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API EndpoinCVE-2026-848588.8ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataCVE-2026-848596.5ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSCVE-2026-84867.5Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affecCVE-2026-848608.8ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, CVE-2026-848627.2IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could ex
CVE-2026-84849: Medium severity, CVSS 6.5 | Vulnix