Advisories · Technology

Premium Packages.

Every CVE that names Premium Packages among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-118407 CVE record

CVSS 5.4 Medium

Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover
- Premium Packages
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-118404 CVE record

CVSS 5.3 Medium

Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR
- Premium Packages
- Information disclosure
Not analysed yet 4 Nov 2026
CVE-2026-118403 CVE record

CVSS 3.7 Low

Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure
- Premium Packages
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-118184 CVE record

CVSS 5.3 Medium

Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation
- Premium Packages
- Broken access control
Not analysed yet 31 Oct 2026
CVE-2026-93511 CVE record

CVSS 5.3 Medium

Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass
- Premium Packages
- Authentication bypass
Not analysed yet 23 Sept 2026
CVE-2026-19711 CVE record

CVSS 6.5 Medium

Premium Packages – Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request
- Premium Packages
- Broken access control
Not analysed yet 16 Aug 2026