https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 11 Aug 2026 01:10:28 +0000 https://vulnerability.circl.lu/sighting/dbbc02de-a2da-44e5-8c76-89667b2a9bbb/export {"uuid": "dbbc02de-a2da-44e5-8c76-89667b2a9bbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/cc9f766d0a2a4c8f1efc2b89a9f8b2eb", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Misc**\n - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)", "creation_timestamp": "2026-08-10T13:47:12.041312Z"} {"uuid": "dbbc02de-a2da-44e5-8c76-89667b2a9bbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/cc9f766d0a2a4c8f1efc2b89a9f8b2eb", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Misc**\n - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)", "creation_timestamp": "2026-08-10T13:47:12.041312Z"} https://vulnerability.circl.lu/sighting/dbbc02de-a2da-44e5-8c76-89667b2a9bbb/export Mon, 10 Aug 2026 13:47:12 +0000 https://vulnerability.circl.lu/sighting/9746b8e2-00d5-4334-9d74-8cbb586586f4/export {"uuid": "9746b8e2-00d5-4334-9d74-8cbb586586f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/jbourdin/d5d5ade20f80dca4ef2a3034a9c1ff3e", "content": "- **Trello**\n - [Helsinki : Portail de retour - Sylius - int\u00e9gration front du portail de retour](https://trello.com/c/mhcc7YaC/2401-helsinki-portail-de-retour-sylius-int%C3%A9gration-front-du-portail-de-retour) **TEMP - EPIC - Droit de r\u00e9tractation**\n - *feat(helsinki): Add return portal to Helsinki order details* [\\#11757](https://github.com/Wishibam/Ecommerce-sylius/pull/11757)\n - [\\[Migration\\]\\[A.2\\] D\u00e9mant\u00e8lement Setono Analytics + Tag-Bag](https://trello.com/c/uJN0Gkiz/3856-migrationa2-d%C3%A9mant%C3%A8lement-setono-analytics-tag-bag) **\ud83e\udd16 Testing tech**\n - *:wrench: chore(migration): internalize setono analytics + tag-bag as src/Component \\[A.2\\]* [\\#11846](https://github.com/Wishibam/Ecommerce-sylius/pull/11846)\n - [\\[Migration\\]\\[A.4.1\\] Internaliser bitbag/wishlist-plugin dans src/Component/Wishlist](https://trello.com/c/U9dQGx1l/3863-migrationa41-internaliser-bitbag-wishlist-plugin-dans-src-component-wishlist) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: internalize bitbag/wishlist-plugin \\[A.4.1\\]* [\\#11856](https://github.com/Wishibam/Ecommerce-sylius/pull/11856)\n - [\\[Migration\\]\\[A.4.2/A.4.3\\] Internaliser bring & deep-link dans src/Component](https://trello.com/c/RsLN5SNT/3864-migrationa42-a43-internaliser-bring-deep-link-dans-src-component) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: internalize bring & deep-link plugins \\[A.4.2, A.4.3\\]* [\\#11861](https://github.com/Wishibam/Ecommerce-sylius/pull/11861)\n - [\\[Migration\\]\\[A.5\\] Bumps frontend \u00ab safe \u00bb + suppression des packages morts](https://trello.com/c/vI6k61gt/3873-migrationa5-bumps-frontend-safe-suppression-des-packages-morts) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: bump safe frontend deps + prune dead packages \\[A.5\\]* [\\#11875](https://github.com/Wishibam/Ecommerce-sylius/pull/11875)\n - [\\[Migration\\]\\[A.6\\] Pr\u00e9paration Doctrine pour DBAL 3 (monkey-patch migrations)](https://trello.com/c/8mdyVMwg/3880-migrationa6-pr%C3%A9paration-doctrine-pour-dbal-3-monkey-patch-migrations) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: replace Doctrine migration monkey-patch for DBAL 3 \\[A.6\\]* [\\#11893](https://github.com/Wishibam/Ecommerce-sylius/pull/11893)\n - [TVO - Express checkout : adresse tronqu\u00e9e \u2014 nom de rue perdu (Apple Pay line1/line2)](https://trello.com/c/dIrl0I1a/3884-tvo-express-checkout-adresse-tronqu%C3%A9e-nom-de-rue-perdu-apple-pay-line1-line2) **\ud83e\udd13 Testing**\n - *:bug: fix: join express checkout wallet address line1/line2 into street* [\\#11914](https://github.com/Wishibam/Ecommerce-sylius/pull/11914)\n - [\\[P0\\] Express checkout : re-v\u00e9rifier le montant du PaymentIntent au complete](https://trello.com/c/qJdTR9Jc/3885-p0-express-checkout-re-v%C3%A9rifier-le-montant-du-paymentintent-au-complete) **\ud83d\udc8e In Review**\n - *:bug: fix: verify express checkout PaymentIntent amount at completion* [\\#11916](https://github.com/Wishibam/Ecommerce-sylius/pull/11916)\n - [\\[P0\\] Webhook Stripe : rembourser r\u00e9ellement les charges des commandes refus\u00e9es/annul\u00e9es](https://trello.com/c/fyJeMD3L/3886-p0-webhook-stripe-rembourser-r%C3%A9ellement-les-charges-des-commandes-refus%C3%A9es-annul%C3%A9es) **\ud83d\udc8e In Review**\n - *:bug: fix: refund Stripe charges captured for refused or cancelled orders* [\\#11918](https://github.com/Wishibam/Ecommerce-sylius/pull/11918)\n - [\\[P1\\] Express checkout : pinner explicitement les wallets autoris\u00e9s (quick win)](https://trello.com/c/tEpmPM9l/3890-p1-express-checkout-pinner-explicitement-les-wallets-autoris%C3%A9s-quick-win) **\ud83e\udd13 Testing**\n - *:bug: fix: restrict express checkout wallets to an explicit allowlist* [\\#11919](https://github.com/Wishibam/Ecommerce-sylius/pull/11919)\n - [\\[P0\\] Express checkout : commandes \u00e0 fonds captur\u00e9s supprim\u00e9es par la purge des carts + cha\u00eene d'abort morte](https://trello.com/c/1Wo7zGP5/3887-p0-express-checkout-commandes-%C3%A0-fonds-captur%C3%A9s-supprim%C3%A9es-par-la-purge-des-carts-cha%C3%AEne-dabort-morte) **\ud83d\udc8e In Review**\n - *:bug: fix: protect express checkout captured-funds carts from the purge* [\\#11920](https://github.com/Wishibam/Ecommerce-sylius/pull/11920)\n - [\ud83d\udc1b Fix r\u00e9indexation ES bloqu\u00e9e \u2014 \u00ab immense term \u00bb sur attribut trop long (Intersport)](https://trello.com/c/iD6idW0v/3915-%F0%9F%90%9B-fix-r%C3%A9indexation-es-bloqu%C3%A9e-immense-term-sur-attribut-trop-long-intersport) **\ud83e\udd16 Testing tech**\n - *:bug: fix: r\u00e9indexation ES bloqu\u00e9e par un attribut trop long (immense term)* [\\#11972](https://github.com/Wishibam/Ecommerce-sylius/pull/11972)\n - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \u203c\ufe0f Nouveau Feeds - Faire tourner tous les nouveaux feeds sur toutes les preprods/prods](https://trello.com/c/Kr8UhDAv/3910-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%EF%B8%8F-nouveau-feeds-faire-tourner-tous-les-nouveaux-feeds-sur-toutes-les-preprods-prods) **\ud83e\udee1 To Do JC**\n - *:sparkles: feat: drive-to-store feeds parity with legacy Setono* [\\#11979](https://github.com/Wishibam/Ecommerce-sylius/pull/11979)\n - [Helsinki \u2014 Funnel checkout GA4 vide : \u00e9v\u00e9nements e-commerce manquants/incomplets](https://trello.com/c/j0yQGSFm/3921-helsinki-funnel-checkout-ga4-vide-%C3%A9v%C3%A9nements-e-commerce-manquants-incomplets) **\ud83c\udf44 Ready for testing**\n - *:bug: fix: \u00e9mettre le funnel checkout GA4 complet* [\\#11980](https://github.com/Wishibam/Ecommerce-sylius/pull/11980)\n - [Min-height pages React](https://trello.com/c/Rti8eFXb/3919-min-height-pages-react) **\ud83e\udd13 Testing**\n - *:bug: fix: add min-height on React pages to prevent footer flash* [\\#11987](https://github.com/Wishibam/Ecommerce-sylius/pull/11987)\n - [\u26a0\ufe0f action preprod/prod \u26a0\ufe0f \ud83d\uded2 Refonte Checkout #1 \u2014 La page Panier change de garde-robe](https://trello.com/c/qxdtlZxk/3851-%E2%9A%A0%EF%B8%8F-action-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9B%92-refonte-checkout-1-la-page-panier-change-de-garde-robe) **\ud83c\udf89 A MEP**\n - *:bug: fix(tvo): cart page QA feedback round* [\\#11990](https://github.com/Wishibam/Ecommerce-sylius/pull/11990)\n - [Fix : TypeError trim() null sur les share descriptions de channel (admin)](https://trello.com/c/o47Ek1Fo/3924-fix-typeerror-trim-null-sur-les-share-descriptions-de-channel-admin) **\ud83e\udd16 Testing tech**\n - *:bug: fix: guard against null share descriptions in channel setter* [\\#11992](https://github.com/Wishibam/Ecommerce-sylius/pull/11992)\n - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \ud83d\udce6\ud83c\udf0d Mondial Relay sans fronti\u00e8res \u2014 points relais UE (v1 TVO)](https://trello.com/c/4X0QYlQ5/3918-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%93%A6%F0%9F%8C%8D-mondial-relay-sans-fronti%C3%A8res-points-relais-ue-v1-tvo) **\ud83d\udc8e In Review**\n - *:sparkles: feat(mondial-relay): relay search follows the buyer's country* [\\#11994](https://github.com/Wishibam/Ecommerce-sylius/pull/11994)\n - [\ud83d\udccd Refonte Checkout \u2014 La suggestion d'adresse qui fait mouche](https://trello.com/c/vF0T1FZU/3860-%F0%9F%93%8D-refonte-checkout-la-suggestion-dadresse-qui-fait-mouche) **\ud83d\ude80 To Do Vincent**\n - *:bug: fix(tvo): address suggestion QA feedback round* [\\#11995](https://github.com/Wishibam/Ecommerce-sylius/pull/11995)\n - [\ud83c\udf5e Refonte Checkout \u2014 Des toasts tout chauds pour les messages syst\u00e8me](https://trello.com/c/N70pstGO/3861-%F0%9F%8D%9E-refonte-checkout-des-toasts-tout-chauds-pour-les-messages-syst%C3%A8me) **\ud83c\udf89 A MEP**\n - *:bug: fix(tvo): checkout toasts QA feedback round* [\\#11996](https://github.com/Wishibam/Ecommerce-sylius/pull/11996)\n - [TVO- mail order\\_open\\_return\\_withdrawn -remplacement de tag](https://trello.com/c/NK5CnCM2/3883-tvo-mail-orderopenreturnwithdrawn-remplacement-de-tag) **\ud83c\udf89 A MEP**\n - *\ud83d\udc1b fix: orange \"return in progress\" badge on TVO withdrawal email* [\\#12000](https://github.com/Wishibam/Ecommerce-sylius/pull/12000)\n - [\u26a0\ufe0f action prod \u26a0\ufe0f \ud83d\ude9a Refonte Checkout #3 \u2014 Le Mode de livraison prend la route](https://trello.com/c/NDSNOimu/3854-%E2%9A%A0%EF%B8%8F-action-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9A%9A-refonte-checkout-3-le-mode-de-livraison-prend-la-route) **\ud83e\udd13 Testing**\n - *:sparkles: feat(tvo): React checkout select shipping step (P3)* [\\#12011](https://github.com/Wishibam/Ecommerce-sylius/pull/12011)\n \n- **Misc**\n - *:sparkles: feat: PushDispatcher + adaptateur FCM (push app TVO)* [\\#11917](https://github.com/Wishibam/Ecommerce-sylius/pull/11917)\n - *style(withdrawal): make the withdrawal button theme-colored and not f\u2026* [\\#11951](https://github.com/Wishibam/Ecommerce-sylius/pull/11951)\n - *:zap: perf: Batavia PLP \u2014 ES result cache, key batching, menu cache* [\\#11963](https://github.com/Wishibam/Ecommerce-sylius/pull/11963)\n - *:wrench: chore: outillage pour worktrees parall\u00e8les (front isol\u00e9 par projet)* [\\#11986](https://github.com/Wishibam/Ecommerce-sylius/pull/11986)\n - *:wrench: chore: bump php\\_codesniffer en 3.13.6 (CVE-2026-67434, CI rouge)* [\\#12008](https://github.com/Wishibam/Ecommerce-sylius/pull/12008)\n \n- **D\u00e9j\u00e0 en production**\n - [TVO - Les recommandations produits ne remontent aucun produit sur la fiche produit](https://trello.com/c/lw3SYgNG/3926-tvo-les-recommandations-produits-ne-remontent-aucun-produit-sur-la-fiche-produit) **MEP Ao\u00fbt**\n - *:bug: fix(search): match the indexed color value in recommendations* [\\#12004](https://github.com/Wishibam/Ecommerce-sylius/pull/12004)\n - *:bug: fix: render flag emojis as SVG icons, not OS emoji glyphs* [\\#11981](https://github.com/Wishibam/Ecommerce-sylius/pull/11981)\n - *:bug: fix: apply the flag icon filter to the remaining menu renderings* [\\#11982](https://github.com/Wishibam/Ecommerce-sylius/pull/11982)", "creation_timestamp": "2026-08-07T16:25:47.248675Z"} {"uuid": "9746b8e2-00d5-4334-9d74-8cbb586586f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/jbourdin/d5d5ade20f80dca4ef2a3034a9c1ff3e", "content": "- **Trello**\n - [Helsinki : Portail de retour - Sylius - int\u00e9gration front du portail de retour](https://trello.com/c/mhcc7YaC/2401-helsinki-portail-de-retour-sylius-int%C3%A9gration-front-du-portail-de-retour) **TEMP - EPIC - Droit de r\u00e9tractation**\n - *feat(helsinki): Add return portal to Helsinki order details* [\\#11757](https://github.com/Wishibam/Ecommerce-sylius/pull/11757)\n - [\\[Migration\\]\\[A.2\\] D\u00e9mant\u00e8lement Setono Analytics + Tag-Bag](https://trello.com/c/uJN0Gkiz/3856-migrationa2-d%C3%A9mant%C3%A8lement-setono-analytics-tag-bag) **\ud83e\udd16 Testing tech**\n - *:wrench: chore(migration): internalize setono analytics + tag-bag as src/Component \\[A.2\\]* [\\#11846](https://github.com/Wishibam/Ecommerce-sylius/pull/11846)\n - [\\[Migration\\]\\[A.4.1\\] Internaliser bitbag/wishlist-plugin dans src/Component/Wishlist](https://trello.com/c/U9dQGx1l/3863-migrationa41-internaliser-bitbag-wishlist-plugin-dans-src-component-wishlist) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: internalize bitbag/wishlist-plugin \\[A.4.1\\]* [\\#11856](https://github.com/Wishibam/Ecommerce-sylius/pull/11856)\n - [\\[Migration\\]\\[A.4.2/A.4.3\\] Internaliser bring & deep-link dans src/Component](https://trello.com/c/RsLN5SNT/3864-migrationa42-a43-internaliser-bring-deep-link-dans-src-component) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: internalize bring & deep-link plugins \\[A.4.2, A.4.3\\]* [\\#11861](https://github.com/Wishibam/Ecommerce-sylius/pull/11861)\n - [\\[Migration\\]\\[A.5\\] Bumps frontend \u00ab safe \u00bb + suppression des packages morts](https://trello.com/c/vI6k61gt/3873-migrationa5-bumps-frontend-safe-suppression-des-packages-morts) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: bump safe frontend deps + prune dead packages \\[A.5\\]* [\\#11875](https://github.com/Wishibam/Ecommerce-sylius/pull/11875)\n - [\\[Migration\\]\\[A.6\\] Pr\u00e9paration Doctrine pour DBAL 3 (monkey-patch migrations)](https://trello.com/c/8mdyVMwg/3880-migrationa6-pr%C3%A9paration-doctrine-pour-dbal-3-monkey-patch-migrations) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: replace Doctrine migration monkey-patch for DBAL 3 \\[A.6\\]* [\\#11893](https://github.com/Wishibam/Ecommerce-sylius/pull/11893)\n - [TVO - Express checkout : adresse tronqu\u00e9e \u2014 nom de rue perdu (Apple Pay line1/line2)](https://trello.com/c/dIrl0I1a/3884-tvo-express-checkout-adresse-tronqu%C3%A9e-nom-de-rue-perdu-apple-pay-line1-line2) **\ud83e\udd13 Testing**\n - *:bug: fix: join express checkout wallet address line1/line2 into street* [\\#11914](https://github.com/Wishibam/Ecommerce-sylius/pull/11914)\n - [\\[P0\\] Express checkout : re-v\u00e9rifier le montant du PaymentIntent au complete](https://trello.com/c/qJdTR9Jc/3885-p0-express-checkout-re-v%C3%A9rifier-le-montant-du-paymentintent-au-complete) **\ud83d\udc8e In Review**\n - *:bug: fix: verify express checkout PaymentIntent amount at completion* [\\#11916](https://github.com/Wishibam/Ecommerce-sylius/pull/11916)\n - [\\[P0\\] Webhook Stripe : rembourser r\u00e9ellement les charges des commandes refus\u00e9es/annul\u00e9es](https://trello.com/c/fyJeMD3L/3886-p0-webhook-stripe-rembourser-r%C3%A9ellement-les-charges-des-commandes-refus%C3%A9es-annul%C3%A9es) **\ud83d\udc8e In Review**\n - *:bug: fix: refund Stripe charges captured for refused or cancelled orders* [\\#11918](https://github.com/Wishibam/Ecommerce-sylius/pull/11918)\n - [\\[P1\\] Express checkout : pinner explicitement les wallets autoris\u00e9s (quick win)](https://trello.com/c/tEpmPM9l/3890-p1-express-checkout-pinner-explicitement-les-wallets-autoris%C3%A9s-quick-win) **\ud83e\udd13 Testing**\n - *:bug: fix: restrict express checkout wallets to an explicit allowlist* [\\#11919](https://github.com/Wishibam/Ecommerce-sylius/pull/11919)\n - [\\[P0\\] Express checkout : commandes \u00e0 fonds captur\u00e9s supprim\u00e9es par la purge des carts + cha\u00eene d'abort morte](https://trello.com/c/1Wo7zGP5/3887-p0-express-checkout-commandes-%C3%A0-fonds-captur%C3%A9s-supprim%C3%A9es-par-la-purge-des-carts-cha%C3%AEne-dabort-morte) **\ud83d\udc8e In Review**\n - *:bug: fix: protect express checkout captured-funds carts from the purge* [\\#11920](https://github.com/Wishibam/Ecommerce-sylius/pull/11920)\n - [\ud83d\udc1b Fix r\u00e9indexation ES bloqu\u00e9e \u2014 \u00ab immense term \u00bb sur attribut trop long (Intersport)](https://trello.com/c/iD6idW0v/3915-%F0%9F%90%9B-fix-r%C3%A9indexation-es-bloqu%C3%A9e-immense-term-sur-attribut-trop-long-intersport) **\ud83e\udd16 Testing tech**\n - *:bug: fix: r\u00e9indexation ES bloqu\u00e9e par un attribut trop long (immense term)* [\\#11972](https://github.com/Wishibam/Ecommerce-sylius/pull/11972)\n - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \u203c\ufe0f Nouveau Feeds - Faire tourner tous les nouveaux feeds sur toutes les preprods/prods](https://trello.com/c/Kr8UhDAv/3910-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%EF%B8%8F-nouveau-feeds-faire-tourner-tous-les-nouveaux-feeds-sur-toutes-les-preprods-prods) **\ud83e\udee1 To Do JC**\n - *:sparkles: feat: drive-to-store feeds parity with legacy Setono* [\\#11979](https://github.com/Wishibam/Ecommerce-sylius/pull/11979)\n - [Helsinki \u2014 Funnel checkout GA4 vide : \u00e9v\u00e9nements e-commerce manquants/incomplets](https://trello.com/c/j0yQGSFm/3921-helsinki-funnel-checkout-ga4-vide-%C3%A9v%C3%A9nements-e-commerce-manquants-incomplets) **\ud83c\udf44 Ready for testing**\n - *:bug: fix: \u00e9mettre le funnel checkout GA4 complet* [\\#11980](https://github.com/Wishibam/Ecommerce-sylius/pull/11980)\n - [Min-height pages React](https://trello.com/c/Rti8eFXb/3919-min-height-pages-react) **\ud83e\udd13 Testing**\n - *:bug: fix: add min-height on React pages to prevent footer flash* [\\#11987](https://github.com/Wishibam/Ecommerce-sylius/pull/11987)\n - [\u26a0\ufe0f action preprod/prod \u26a0\ufe0f \ud83d\uded2 Refonte Checkout #1 \u2014 La page Panier change de garde-robe](https://trello.com/c/qxdtlZxk/3851-%E2%9A%A0%EF%B8%8F-action-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9B%92-refonte-checkout-1-la-page-panier-change-de-garde-robe) **\ud83c\udf89 A MEP**\n - *:bug: fix(tvo): cart page QA feedback round* [\\#11990](https://github.com/Wishibam/Ecommerce-sylius/pull/11990)\n - [Fix : TypeError trim() null sur les share descriptions de channel (admin)](https://trello.com/c/o47Ek1Fo/3924-fix-typeerror-trim-null-sur-les-share-descriptions-de-channel-admin) **\ud83e\udd16 Testing tech**\n - *:bug: fix: guard against null share descriptions in channel setter* [\\#11992](https://github.com/Wishibam/Ecommerce-sylius/pull/11992)\n - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \ud83d\udce6\ud83c\udf0d Mondial Relay sans fronti\u00e8res \u2014 points relais UE (v1 TVO)](https://trello.com/c/4X0QYlQ5/3918-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%93%A6%F0%9F%8C%8D-mondial-relay-sans-fronti%C3%A8res-points-relais-ue-v1-tvo) **\ud83d\udc8e In Review**\n - *:sparkles: feat(mondial-relay): relay search follows the buyer's country* [\\#11994](https://github.com/Wishibam/Ecommerce-sylius/pull/11994)\n - [\ud83d\udccd Refonte Checkout \u2014 La suggestion d'adresse qui fait mouche](https://trello.com/c/vF0T1FZU/3860-%F0%9F%93%8D-refonte-checkout-la-suggestion-dadresse-qui-fait-mouche) **\ud83d\ude80 To Do Vincent**\n - *:bug: fix(tvo): address suggestion QA feedback round* [\\#11995](https://github.com/Wishibam/Ecommerce-sylius/pull/11995)\n - [\ud83c\udf5e Refonte Checkout \u2014 Des toasts tout chauds pour les messages syst\u00e8me](https://trello.com/c/N70pstGO/3861-%F0%9F%8D%9E-refonte-checkout-des-toasts-tout-chauds-pour-les-messages-syst%C3%A8me) **\ud83c\udf89 A MEP**\n - *:bug: fix(tvo): checkout toasts QA feedback round* [\\#11996](https://github.com/Wishibam/Ecommerce-sylius/pull/11996)\n - [TVO- mail order\\_open\\_return\\_withdrawn -remplacement de tag](https://trello.com/c/NK5CnCM2/3883-tvo-mail-orderopenreturnwithdrawn-remplacement-de-tag) **\ud83c\udf89 A MEP**\n - *\ud83d\udc1b fix: orange \"return in progress\" badge on TVO withdrawal email* [\\#12000](https://github.com/Wishibam/Ecommerce-sylius/pull/12000)\n - [\u26a0\ufe0f action prod \u26a0\ufe0f \ud83d\ude9a Refonte Checkout #3 \u2014 Le Mode de livraison prend la route](https://trello.com/c/NDSNOimu/3854-%E2%9A%A0%EF%B8%8F-action-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9A%9A-refonte-checkout-3-le-mode-de-livraison-prend-la-route) **\ud83e\udd13 Testing**\n - *:sparkles: feat(tvo): React checkout select shipping step (P3)* [\\#12011](https://github.com/Wishibam/Ecommerce-sylius/pull/12011)\n \n- **Misc**\n - *:sparkles: feat: PushDispatcher + adaptateur FCM (push app TVO)* [\\#11917](https://github.com/Wishibam/Ecommerce-sylius/pull/11917)\n - *style(withdrawal): make the withdrawal button theme-colored and not f\u2026* [\\#11951](https://github.com/Wishibam/Ecommerce-sylius/pull/11951)\n - *:zap: perf: Batavia PLP \u2014 ES result cache, key batching, menu cache* [\\#11963](https://github.com/Wishibam/Ecommerce-sylius/pull/11963)\n - *:wrench: chore: outillage pour worktrees parall\u00e8les (front isol\u00e9 par projet)* [\\#11986](https://github.com/Wishibam/Ecommerce-sylius/pull/11986)\n - *:wrench: chore: bump php\\_codesniffer en 3.13.6 (CVE-2026-67434, CI rouge)* [\\#12008](https://github.com/Wishibam/Ecommerce-sylius/pull/12008)\n \n- **D\u00e9j\u00e0 en production**\n - [TVO - Les recommandations produits ne remontent aucun produit sur la fiche produit](https://trello.com/c/lw3SYgNG/3926-tvo-les-recommandations-produits-ne-remontent-aucun-produit-sur-la-fiche-produit) **MEP Ao\u00fbt**\n - *:bug: fix(search): match the indexed color value in recommendations* [\\#12004](https://github.com/Wishibam/Ecommerce-sylius/pull/12004)\n - *:bug: fix: render flag emojis as SVG icons, not OS emoji glyphs* [\\#11981](https://github.com/Wishibam/Ecommerce-sylius/pull/11981)\n - *:bug: fix: apply the flag icon filter to the remaining menu renderings* [\\#11982](https://github.com/Wishibam/Ecommerce-sylius/pull/11982)", "creation_timestamp": "2026-08-07T16:25:47.248675Z"} https://vulnerability.circl.lu/sighting/9746b8e2-00d5-4334-9d74-8cbb586586f4/export Fri, 07 Aug 2026 16:25:47 +0000 https://vulnerability.circl.lu/sighting/f41d2170-c202-4064-bd7b-3c0673172f9f/export {"uuid": "f41d2170-c202-4064-bd7b-3c0673172f9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/jbourdin/04337c13ed0986eb35ae2dd9fd10e882", "content": "- **Trello**\n - [Helsinki : Portail de retour - Sylius - int\u00e9gration front du portail de retour](https://trello.com/c/mhcc7YaC/2401-helsinki-portail-de-retour-sylius-int%C3%A9gration-front-du-portail-de-retour) **TEMP - EPIC - Droit de r\u00e9tractation**\n - *feat(helsinki): Add return portal to Helsinki order details* [\\#11757](https://github.com/Wishibam/Ecommerce-sylius/pull/11757)\n - [\\[Migration\\]\\[A.2\\] D\u00e9mant\u00e8lement Setono Analytics + Tag-Bag](https://trello.com/c/uJN0Gkiz/3856-migrationa2-d%C3%A9mant%C3%A8lement-setono-analytics-tag-bag) **\ud83e\udd16 Testing tech**\n - *:wrench: chore(migration): internalize setono analytics + tag-bag as src/Component \\[A.2\\]* [\\#11846](https://github.com/Wishibam/Ecommerce-sylius/pull/11846)\n - [\\[Migration\\]\\[A.4.1\\] Internaliser bitbag/wishlist-plugin dans src/Component/Wishlist](https://trello.com/c/U9dQGx1l/3863-migrationa41-internaliser-bitbag-wishlist-plugin-dans-src-component-wishlist) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: internalize bitbag/wishlist-plugin \\[A.4.1\\]* [\\#11856](https://github.com/Wishibam/Ecommerce-sylius/pull/11856)\n - [\\[Migration\\]\\[A.4.2/A.4.3\\] Internaliser bring & deep-link dans src/Component](https://trello.com/c/RsLN5SNT/3864-migrationa42-a43-internaliser-bring-deep-link-dans-src-component) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: internalize bring & deep-link plugins \\[A.4.2, A.4.3\\]* [\\#11861](https://github.com/Wishibam/Ecommerce-sylius/pull/11861)\n - [\\[Migration\\]\\[A.5\\] Bumps frontend \u00ab safe \u00bb + suppression des packages morts](https://trello.com/c/vI6k61gt/3873-migrationa5-bumps-frontend-safe-suppression-des-packages-morts) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: bump safe frontend deps + prune dead packages \\[A.5\\]* [\\#11875](https://github.com/Wishibam/Ecommerce-sylius/pull/11875)\n - [\\[Migration\\]\\[A.6\\] Pr\u00e9paration Doctrine pour DBAL 3 (monkey-patch migrations)](https://trello.com/c/8mdyVMwg/3880-migrationa6-pr%C3%A9paration-doctrine-pour-dbal-3-monkey-patch-migrations) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: replace Doctrine migration monkey-patch for DBAL 3 \\[A.6\\]* [\\#11893](https://github.com/Wishibam/Ecommerce-sylius/pull/11893)\n - [TVO - Express checkout : adresse tronqu\u00e9e \u2014 nom de rue perdu (Apple Pay line1/line2)](https://trello.com/c/dIrl0I1a/3884-tvo-express-checkout-adresse-tronqu%C3%A9e-nom-de-rue-perdu-apple-pay-line1-line2) **\ud83e\udd13 Testing**\n - *:bug: fix: join express checkout wallet address line1/line2 into street* [\\#11914](https://github.com/Wishibam/Ecommerce-sylius/pull/11914)\n - [\\[P0\\] Webhook Stripe : rembourser r\u00e9ellement les charges des commandes refus\u00e9es/annul\u00e9es](https://trello.com/c/fyJeMD3L/3886-p0-webhook-stripe-rembourser-r%C3%A9ellement-les-charges-des-commandes-refus%C3%A9es-annul%C3%A9es) **\ud83d\udc8e In Review**\n - *:bug: fix: refund Stripe charges captured for refused or cancelled orders* [\\#11918](https://github.com/Wishibam/Ecommerce-sylius/pull/11918)\n - [\\[P1\\] Express checkout : pinner explicitement les wallets autoris\u00e9s (quick win)](https://trello.com/c/tEpmPM9l/3890-p1-express-checkout-pinner-explicitement-les-wallets-autoris%C3%A9s-quick-win) **\ud83e\udd13 Testing**\n - *:bug: fix: restrict express checkout wallets to an explicit allowlist* [\\#11919](https://github.com/Wishibam/Ecommerce-sylius/pull/11919)\n - [\\[P0\\] Express checkout : commandes \u00e0 fonds captur\u00e9s supprim\u00e9es par la purge des carts + cha\u00eene d'abort morte](https://trello.com/c/1Wo7zGP5/3887-p0-express-checkout-commandes-%C3%A0-fonds-captur%C3%A9s-supprim%C3%A9es-par-la-purge-des-carts-cha%C3%AEne-dabort-morte) **\ud83d\udc8e In Review**\n - *:bug: fix: protect express checkout captured-funds carts from the purge* [\\#11920](https://github.com/Wishibam/Ecommerce-sylius/pull/11920)\n - [\ud83d\udc1b Fix r\u00e9indexation ES bloqu\u00e9e \u2014 \u00ab immense term \u00bb sur attribut trop long (Intersport)](https://trello.com/c/iD6idW0v/3915-%F0%9F%90%9B-fix-r%C3%A9indexation-es-bloqu%C3%A9e-immense-term-sur-attribut-trop-long-intersport) **\ud83e\udd16 Testing tech**\n - *:bug: fix: r\u00e9indexation ES bloqu\u00e9e par un attribut trop long (immense term)* [\\#11972](https://github.com/Wishibam/Ecommerce-sylius/pull/11972)\n - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \u203c\ufe0f Nouveau Feeds - Faire tourner tous les nouveaux feeds sur toutes les preprods/prods](https://trello.com/c/Kr8UhDAv/3910-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%EF%B8%8F-nouveau-feeds-faire-tourner-tous-les-nouveaux-feeds-sur-toutes-les-preprods-prods) **\ud83e\udee1 To Do JC**\n - *:sparkles: feat: drive-to-store feeds parity with legacy Setono* [\\#11979](https://github.com/Wishibam/Ecommerce-sylius/pull/11979)\n - [Helsinki \u2014 Funnel checkout GA4 vide : \u00e9v\u00e9nements e-commerce manquants/incomplets](https://trello.com/c/j0yQGSFm/3921-helsinki-funnel-checkout-ga4-vide-%C3%A9v%C3%A9nements-e-commerce-manquants-incomplets) **\ud83c\udf44 Ready for testing**\n - *:bug: fix: \u00e9mettre le funnel checkout GA4 complet* [\\#11980](https://github.com/Wishibam/Ecommerce-sylius/pull/11980)\n - [Min-height pages React](https://trello.com/c/Rti8eFXb/3919-min-height-pages-react) **\ud83e\udd13 Testing**\n - *:bug: fix: add min-height on React pages to prevent footer flash* [\\#11987](https://github.com/Wishibam/Ecommerce-sylius/pull/11987)\n - [\u26a0\ufe0f action preprod/prod \u26a0\ufe0f \ud83d\uded2 Refonte Checkout #1 \u2014 La page Panier change de garde-robe](https://trello.com/c/qxdtlZxk/3851-%E2%9A%A0%EF%B8%8F-action-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9B%92-refonte-checkout-1-la-page-panier-change-de-garde-robe) **\ud83c\udf89 A MEP**\n - *:bug: fix(tvo): cart page QA feedback round* [\\#11990](https://github.com/Wishibam/Ecommerce-sylius/pull/11990)\n - [Fix : TypeError trim() null sur les share descriptions de channel (admin)](https://trello.com/c/o47Ek1Fo/3924-fix-typeerror-trim-null-sur-les-share-descriptions-de-channel-admin) **\ud83e\udd16 Testing tech**\n - *:bug: fix: guard against null share descriptions in channel setter* [\\#11992](https://github.com/Wishibam/Ecommerce-sylius/pull/11992)\n - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \ud83d\udce6\ud83c\udf0d Mondial Relay sans fronti\u00e8res \u2014 points relais UE (v1 TVO)](https://trello.com/c/4X0QYlQ5/3918-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%93%A6%F0%9F%8C%8D-mondial-relay-sans-fronti%C3%A8res-points-relais-ue-v1-tvo) **\ud83d\udc8e In Review**\n - *:sparkles: feat(mondial-relay): relay search follows the buyer's country* [\\#11994](https://github.com/Wishibam/Ecommerce-sylius/pull/11994)\n - [\ud83d\udccd Refonte Checkout \u2014 La suggestion d'adresse qui fait mouche](https://trello.com/c/vF0T1FZU/3860-%F0%9F%93%8D-refonte-checkout-la-suggestion-dadresse-qui-fait-mouche) **\ud83d\ude80 To Do Vincent**\n - *:bug: fix(tvo): address suggestion QA feedback round* [\\#11995](https://github.com/Wishibam/Ecommerce-sylius/pull/11995)\n - [\ud83c\udf5e Refonte Checkout \u2014 Des toasts tout chauds pour les messages syst\u00e8me](https://trello.com/c/N70pstGO/3861-%F0%9F%8D%9E-refonte-checkout-des-toasts-tout-chauds-pour-les-messages-syst%C3%A8me) **\ud83c\udf89 A MEP**\n - *:bug: fix(tvo): checkout toasts QA feedback round* [\\#11996](https://github.com/Wishibam/Ecommerce-sylius/pull/11996)\n - [TVO- mail order\\_open\\_return\\_withdrawn -remplacement de tag](https://trello.com/c/NK5CnCM2/3883-tvo-mail-orderopenreturnwithdrawn-remplacement-de-tag) **\ud83c\udf89 A MEP**\n - *\ud83d\udc1b fix: orange \"return in progress\" badge on TVO withdrawal email* [\\#12000](https://github.com/Wishibam/Ecommerce-sylius/pull/12000)\n - [\u26a0\ufe0f action prod \u26a0\ufe0f \ud83d\ude9a Refonte Checkout #3 \u2014 Le Mode de livraison prend la route](https://trello.com/c/NDSNOimu/3854-%E2%9A%A0%EF%B8%8F-action-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9A%9A-refonte-checkout-3-le-mode-de-livraison-prend-la-route) **\ud83e\udd13 Testing**\n - *:sparkles: feat(tvo): React checkout select shipping step (P3)* [\\#12011](https://github.com/Wishibam/Ecommerce-sylius/pull/12011)\n \n- **Misc**\n - *:sparkles: feat: PushDispatcher + adaptateur FCM (push app TVO)* [\\#11917](https://github.com/Wishibam/Ecommerce-sylius/pull/11917)\n - *style(withdrawal): make the withdrawal button theme-colored and not f\u2026* [\\#11951](https://github.com/Wishibam/Ecommerce-sylius/pull/11951)\n - *:zap: perf: Batavia PLP \u2014 ES result cache, key batching, menu cache* [\\#11963](https://github.com/Wishibam/Ecommerce-sylius/pull/11963)\n - *:wrench: chore: outillage pour worktrees parall\u00e8les (front isol\u00e9 par projet)* [\\#11986](https://github.com/Wishibam/Ecommerce-sylius/pull/11986)\n - *:wrench: chore: bump php\\_codesniffer en 3.13.6 (CVE-2026-67434, CI rouge)* [\\#12008](https://github.com/Wishibam/Ecommerce-sylius/pull/12008)\n \n- **D\u00e9j\u00e0 en production**\n - [TVO - Les recommandations produits ne remontent aucun produit sur la fiche produit](https://trello.com/c/lw3SYgNG/3926-tvo-les-recommandations-produits-ne-remontent-aucun-produit-sur-la-fiche-produit) **MEP Ao\u00fbt**\n - *:bug: fix(search): match the indexed color value in recommendations* [\\#12004](https://github.com/Wishibam/Ecommerce-sylius/pull/12004)\n - *:bug: fix: render flag emojis as SVG icons, not OS emoji glyphs* [\\#11981](https://github.com/Wishibam/Ecommerce-sylius/pull/11981)\n - *:bug: fix: apply the flag icon filter to the remaining menu renderings* [\\#11982](https://github.com/Wishibam/Ecommerce-sylius/pull/11982)", "creation_timestamp": "2026-08-07T15:50:54.562361Z"} {"uuid": "f41d2170-c202-4064-bd7b-3c0673172f9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/jbourdin/04337c13ed0986eb35ae2dd9fd10e882", "content": "- **Trello**\n - [Helsinki : Portail de retour - Sylius - int\u00e9gration front du portail de retour](https://trello.com/c/mhcc7YaC/2401-helsinki-portail-de-retour-sylius-int%C3%A9gration-front-du-portail-de-retour) **TEMP - EPIC - Droit de r\u00e9tractation**\n - *feat(helsinki): Add return portal to Helsinki order details* [\\#11757](https://github.com/Wishibam/Ecommerce-sylius/pull/11757)\n - [\\[Migration\\]\\[A.2\\] D\u00e9mant\u00e8lement Setono Analytics + Tag-Bag](https://trello.com/c/uJN0Gkiz/3856-migrationa2-d%C3%A9mant%C3%A8lement-setono-analytics-tag-bag) **\ud83e\udd16 Testing tech**\n - *:wrench: chore(migration): internalize setono analytics + tag-bag as src/Component \\[A.2\\]* [\\#11846](https://github.com/Wishibam/Ecommerce-sylius/pull/11846)\n - [\\[Migration\\]\\[A.4.1\\] Internaliser bitbag/wishlist-plugin dans src/Component/Wishlist](https://trello.com/c/U9dQGx1l/3863-migrationa41-internaliser-bitbag-wishlist-plugin-dans-src-component-wishlist) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: internalize bitbag/wishlist-plugin \\[A.4.1\\]* [\\#11856](https://github.com/Wishibam/Ecommerce-sylius/pull/11856)\n - [\\[Migration\\]\\[A.4.2/A.4.3\\] Internaliser bring & deep-link dans src/Component](https://trello.com/c/RsLN5SNT/3864-migrationa42-a43-internaliser-bring-deep-link-dans-src-component) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: internalize bring & deep-link plugins \\[A.4.2, A.4.3\\]* [\\#11861](https://github.com/Wishibam/Ecommerce-sylius/pull/11861)\n - [\\[Migration\\]\\[A.5\\] Bumps frontend \u00ab safe \u00bb + suppression des packages morts](https://trello.com/c/vI6k61gt/3873-migrationa5-bumps-frontend-safe-suppression-des-packages-morts) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: bump safe frontend deps + prune dead packages \\[A.5\\]* [\\#11875](https://github.com/Wishibam/Ecommerce-sylius/pull/11875)\n - [\\[Migration\\]\\[A.6\\] Pr\u00e9paration Doctrine pour DBAL 3 (monkey-patch migrations)](https://trello.com/c/8mdyVMwg/3880-migrationa6-pr%C3%A9paration-doctrine-pour-dbal-3-monkey-patch-migrations) **\ud83e\udd16 Testing tech**\n - *:wrench: chore: replace Doctrine migration monkey-patch for DBAL 3 \\[A.6\\]* [\\#11893](https://github.com/Wishibam/Ecommerce-sylius/pull/11893)\n - [TVO - Express checkout : adresse tronqu\u00e9e \u2014 nom de rue perdu (Apple Pay line1/line2)](https://trello.com/c/dIrl0I1a/3884-tvo-express-checkout-adresse-tronqu%C3%A9e-nom-de-rue-perdu-apple-pay-line1-line2) **\ud83e\udd13 Testing**\n - *:bug: fix: join express checkout wallet address line1/line2 into street* [\\#11914](https://github.com/Wishibam/Ecommerce-sylius/pull/11914)\n - [\\[P0\\] Webhook Stripe : rembourser r\u00e9ellement les charges des commandes refus\u00e9es/annul\u00e9es](https://trello.com/c/fyJeMD3L/3886-p0-webhook-stripe-rembourser-r%C3%A9ellement-les-charges-des-commandes-refus%C3%A9es-annul%C3%A9es) **\ud83d\udc8e In Review**\n - *:bug: fix: refund Stripe charges captured for refused or cancelled orders* [\\#11918](https://github.com/Wishibam/Ecommerce-sylius/pull/11918)\n - [\\[P1\\] Express checkout : pinner explicitement les wallets autoris\u00e9s (quick win)](https://trello.com/c/tEpmPM9l/3890-p1-express-checkout-pinner-explicitement-les-wallets-autoris%C3%A9s-quick-win) **\ud83e\udd13 Testing**\n - *:bug: fix: restrict express checkout wallets to an explicit allowlist* [\\#11919](https://github.com/Wishibam/Ecommerce-sylius/pull/11919)\n - [\\[P0\\] Express checkout : commandes \u00e0 fonds captur\u00e9s supprim\u00e9es par la purge des carts + cha\u00eene d'abort morte](https://trello.com/c/1Wo7zGP5/3887-p0-express-checkout-commandes-%C3%A0-fonds-captur%C3%A9s-supprim%C3%A9es-par-la-purge-des-carts-cha%C3%AEne-dabort-morte) **\ud83d\udc8e In Review**\n - *:bug: fix: protect express checkout captured-funds carts from the purge* [\\#11920](https://github.com/Wishibam/Ecommerce-sylius/pull/11920)\n - [\ud83d\udc1b Fix r\u00e9indexation ES bloqu\u00e9e \u2014 \u00ab immense term \u00bb sur attribut trop long (Intersport)](https://trello.com/c/iD6idW0v/3915-%F0%9F%90%9B-fix-r%C3%A9indexation-es-bloqu%C3%A9e-immense-term-sur-attribut-trop-long-intersport) **\ud83e\udd16 Testing tech**\n - *:bug: fix: r\u00e9indexation ES bloqu\u00e9e par un attribut trop long (immense term)* [\\#11972](https://github.com/Wishibam/Ecommerce-sylius/pull/11972)\n - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \u203c\ufe0f Nouveau Feeds - Faire tourner tous les nouveaux feeds sur toutes les preprods/prods](https://trello.com/c/Kr8UhDAv/3910-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%EF%B8%8F-nouveau-feeds-faire-tourner-tous-les-nouveaux-feeds-sur-toutes-les-preprods-prods) **\ud83e\udee1 To Do JC**\n - *:sparkles: feat: drive-to-store feeds parity with legacy Setono* [\\#11979](https://github.com/Wishibam/Ecommerce-sylius/pull/11979)\n - [Helsinki \u2014 Funnel checkout GA4 vide : \u00e9v\u00e9nements e-commerce manquants/incomplets](https://trello.com/c/j0yQGSFm/3921-helsinki-funnel-checkout-ga4-vide-%C3%A9v%C3%A9nements-e-commerce-manquants-incomplets) **\ud83c\udf44 Ready for testing**\n - *:bug: fix: \u00e9mettre le funnel checkout GA4 complet* [\\#11980](https://github.com/Wishibam/Ecommerce-sylius/pull/11980)\n - [Min-height pages React](https://trello.com/c/Rti8eFXb/3919-min-height-pages-react) **\ud83e\udd13 Testing**\n - *:bug: fix: add min-height on React pages to prevent footer flash* [\\#11987](https://github.com/Wishibam/Ecommerce-sylius/pull/11987)\n - [\u26a0\ufe0f action preprod/prod \u26a0\ufe0f \ud83d\uded2 Refonte Checkout #1 \u2014 La page Panier change de garde-robe](https://trello.com/c/qxdtlZxk/3851-%E2%9A%A0%EF%B8%8F-action-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9B%92-refonte-checkout-1-la-page-panier-change-de-garde-robe) **\ud83c\udf89 A MEP**\n - *:bug: fix(tvo): cart page QA feedback round* [\\#11990](https://github.com/Wishibam/Ecommerce-sylius/pull/11990)\n - [Fix : TypeError trim() null sur les share descriptions de channel (admin)](https://trello.com/c/o47Ek1Fo/3924-fix-typeerror-trim-null-sur-les-share-descriptions-de-channel-admin) **\ud83e\udd16 Testing tech**\n - *:bug: fix: guard against null share descriptions in channel setter* [\\#11992](https://github.com/Wishibam/Ecommerce-sylius/pull/11992)\n - [\u26a0\ufe0faction preprod/prod \u26a0\ufe0f \ud83d\udce6\ud83c\udf0d Mondial Relay sans fronti\u00e8res \u2014 points relais UE (v1 TVO)](https://trello.com/c/4X0QYlQ5/3918-%E2%9A%A0%EF%B8%8Faction-preprod-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%93%A6%F0%9F%8C%8D-mondial-relay-sans-fronti%C3%A8res-points-relais-ue-v1-tvo) **\ud83d\udc8e In Review**\n - *:sparkles: feat(mondial-relay): relay search follows the buyer's country* [\\#11994](https://github.com/Wishibam/Ecommerce-sylius/pull/11994)\n - [\ud83d\udccd Refonte Checkout \u2014 La suggestion d'adresse qui fait mouche](https://trello.com/c/vF0T1FZU/3860-%F0%9F%93%8D-refonte-checkout-la-suggestion-dadresse-qui-fait-mouche) **\ud83d\ude80 To Do Vincent**\n - *:bug: fix(tvo): address suggestion QA feedback round* [\\#11995](https://github.com/Wishibam/Ecommerce-sylius/pull/11995)\n - [\ud83c\udf5e Refonte Checkout \u2014 Des toasts tout chauds pour les messages syst\u00e8me](https://trello.com/c/N70pstGO/3861-%F0%9F%8D%9E-refonte-checkout-des-toasts-tout-chauds-pour-les-messages-syst%C3%A8me) **\ud83c\udf89 A MEP**\n - *:bug: fix(tvo): checkout toasts QA feedback round* [\\#11996](https://github.com/Wishibam/Ecommerce-sylius/pull/11996)\n - [TVO- mail order\\_open\\_return\\_withdrawn -remplacement de tag](https://trello.com/c/NK5CnCM2/3883-tvo-mail-orderopenreturnwithdrawn-remplacement-de-tag) **\ud83c\udf89 A MEP**\n - *\ud83d\udc1b fix: orange \"return in progress\" badge on TVO withdrawal email* [\\#12000](https://github.com/Wishibam/Ecommerce-sylius/pull/12000)\n - [\u26a0\ufe0f action prod \u26a0\ufe0f \ud83d\ude9a Refonte Checkout #3 \u2014 Le Mode de livraison prend la route](https://trello.com/c/NDSNOimu/3854-%E2%9A%A0%EF%B8%8F-action-prod-%E2%9A%A0%EF%B8%8F-%F0%9F%9A%9A-refonte-checkout-3-le-mode-de-livraison-prend-la-route) **\ud83e\udd13 Testing**\n - *:sparkles: feat(tvo): React checkout select shipping step (P3)* [\\#12011](https://github.com/Wishibam/Ecommerce-sylius/pull/12011)\n \n- **Misc**\n - *:sparkles: feat: PushDispatcher + adaptateur FCM (push app TVO)* [\\#11917](https://github.com/Wishibam/Ecommerce-sylius/pull/11917)\n - *style(withdrawal): make the withdrawal button theme-colored and not f\u2026* [\\#11951](https://github.com/Wishibam/Ecommerce-sylius/pull/11951)\n - *:zap: perf: Batavia PLP \u2014 ES result cache, key batching, menu cache* [\\#11963](https://github.com/Wishibam/Ecommerce-sylius/pull/11963)\n - *:wrench: chore: outillage pour worktrees parall\u00e8les (front isol\u00e9 par projet)* [\\#11986](https://github.com/Wishibam/Ecommerce-sylius/pull/11986)\n - *:wrench: chore: bump php\\_codesniffer en 3.13.6 (CVE-2026-67434, CI rouge)* [\\#12008](https://github.com/Wishibam/Ecommerce-sylius/pull/12008)\n \n- **D\u00e9j\u00e0 en production**\n - [TVO - Les recommandations produits ne remontent aucun produit sur la fiche produit](https://trello.com/c/lw3SYgNG/3926-tvo-les-recommandations-produits-ne-remontent-aucun-produit-sur-la-fiche-produit) **MEP Ao\u00fbt**\n - *:bug: fix(search): match the indexed color value in recommendations* [\\#12004](https://github.com/Wishibam/Ecommerce-sylius/pull/12004)\n - *:bug: fix: render flag emojis as SVG icons, not OS emoji glyphs* [\\#11981](https://github.com/Wishibam/Ecommerce-sylius/pull/11981)\n - *:bug: fix: apply the flag icon filter to the remaining menu renderings* [\\#11982](https://github.com/Wishibam/Ecommerce-sylius/pull/11982)", "creation_timestamp": "2026-08-07T15:50:54.562361Z"} https://vulnerability.circl.lu/sighting/f41d2170-c202-4064-bd7b-3c0673172f9f/export Fri, 07 Aug 2026 15:50:54 +0000 https://vulnerability.circl.lu/sighting/e40705c2-14ae-4c30-ae1f-6af35e0b7e54/export {"uuid": "e40705c2-14ae-4c30-ae1f-6af35e0b7e54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/alon710/a294e95161c29ae2353666d3ed774930", "content": "# CVE-2026-67434: CVE-2026-67434: OS Command Injection via Malicious Filenames in PHP_CodeSniffer Blame Reports\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67434\n\n## Summary\nA critical OS command injection vulnerability exists in PHP_CodeSniffer's VCS blame report modules (Gitblame, Hgblame, Svnblame). Due to inadequate escaping of filenames passed to shell execution wrappers like popen(), an attacker who commits a file with a maliciously crafted name can execute arbitrary commands when the victim generates a blame report.\n\n## TL;DR\nUnauthenticated OS command injection in PHP_CodeSniffer VCS reports due to unescaped filename concatenation in popen() calls.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78\n- **Attack Vector**: Local\n- **CVSS Score**: 7.3\n- **EPSS Score**: Not established\n- **Impact**: Arbitrary Code Execution\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- PHP_CodeSniffer\n- **PHP_CodeSniffer**: < 3.13.6 (Fixed in: `3.13.6`)\n- **PHP_CodeSniffer**: >= 4.0.0, < 4.0.2 (Fixed in: `4.0.2`)\n\n## Mitigation\n\n- Upgrade to PHP_CodeSniffer 3.13.6 or 4.0.2 to safely escape arguments.\n- Avoid executing PHP_CodeSniffer with blame reports enabled (--report=Gitblame, --report=Hgblame, --report=Svnblame) on untrusted repositories.\n- Implement pre-commit or pre-scan sanitization checks in CI pipelines to validate filenames against command metacharacters.\n\n**Remediation Steps:**\n1. Run 'composer update squizlabs/php_codesniffer' in your dependency manifest.\n2. Ensure version constraint resolutions point to 3.13.6+ or 4.0.2+.\n3. Audit CI build definitions and remove VCS blame reporting flags until software is patched.\n4. Configure pipeline scanners to block filenames containing characters like '$', '`', ';', and '|'.\n\n## References\n\n- [CVE-2026-67434 Record](https://www.cve.org/CVERecord?id=CVE-2026-67434)\n- [GitHub Security Advisory GHSA-hmqg-cxww-wqhq](https://github.com/PHPCSStandards/PHP_CodeSniffer/security/advisories/GHSA-hmqg-cxww-wqhq)\n- [GitHub Pull Request #1473](https://github.com/PHPCSStandards/PHP_CodeSniffer/pull/1473)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67434) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T04:31:19.319540Z"} {"uuid": "e40705c2-14ae-4c30-ae1f-6af35e0b7e54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/alon710/a294e95161c29ae2353666d3ed774930", "content": "# CVE-2026-67434: CVE-2026-67434: OS Command Injection via Malicious Filenames in PHP_CodeSniffer Blame Reports\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67434\n\n## Summary\nA critical OS command injection vulnerability exists in PHP_CodeSniffer's VCS blame report modules (Gitblame, Hgblame, Svnblame). Due to inadequate escaping of filenames passed to shell execution wrappers like popen(), an attacker who commits a file with a maliciously crafted name can execute arbitrary commands when the victim generates a blame report.\n\n## TL;DR\nUnauthenticated OS command injection in PHP_CodeSniffer VCS reports due to unescaped filename concatenation in popen() calls.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78\n- **Attack Vector**: Local\n- **CVSS Score**: 7.3\n- **EPSS Score**: Not established\n- **Impact**: Arbitrary Code Execution\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- PHP_CodeSniffer\n- **PHP_CodeSniffer**: < 3.13.6 (Fixed in: `3.13.6`)\n- **PHP_CodeSniffer**: >= 4.0.0, < 4.0.2 (Fixed in: `4.0.2`)\n\n## Mitigation\n\n- Upgrade to PHP_CodeSniffer 3.13.6 or 4.0.2 to safely escape arguments.\n- Avoid executing PHP_CodeSniffer with blame reports enabled (--report=Gitblame, --report=Hgblame, --report=Svnblame) on untrusted repositories.\n- Implement pre-commit or pre-scan sanitization checks in CI pipelines to validate filenames against command metacharacters.\n\n**Remediation Steps:**\n1. Run 'composer update squizlabs/php_codesniffer' in your dependency manifest.\n2. Ensure version constraint resolutions point to 3.13.6+ or 4.0.2+.\n3. Audit CI build definitions and remove VCS blame reporting flags until software is patched.\n4. Configure pipeline scanners to block filenames containing characters like '$', '`', ';', and '|'.\n\n## References\n\n- [CVE-2026-67434 Record](https://www.cve.org/CVERecord?id=CVE-2026-67434)\n- [GitHub Security Advisory GHSA-hmqg-cxww-wqhq](https://github.com/PHPCSStandards/PHP_CodeSniffer/security/advisories/GHSA-hmqg-cxww-wqhq)\n- [GitHub Pull Request #1473](https://github.com/PHPCSStandards/PHP_CodeSniffer/pull/1473)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67434) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T04:31:19.319540Z"} https://vulnerability.circl.lu/sighting/e40705c2-14ae-4c30-ae1f-6af35e0b7e54/export Fri, 07 Aug 2026 04:31:19 +0000 https://vulnerability.circl.lu/sighting/dcf5ec43-cd89-48fd-8652-f370ff704b88/export {"uuid": "dcf5ec43-cd89-48fd-8652-f370ff704b88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/ce0e6938e2c8aa7a093b16e80373dccf", "content": "## \ud83d\udd17 Companion release\n\nNo open **Marketplace-client (frontend)** release PR found yet \u2014 it will be linked automatically once it exists.\n\n- https://github.com/Wishibam/Marketplace-client/pulls?q=is%3Apr+is%3Aopen+base%3Amaster+head%3Adevelop\n\n- **Misc**\n - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)", "creation_timestamp": "2026-08-06T14:59:38.220856Z"} {"uuid": "dcf5ec43-cd89-48fd-8652-f370ff704b88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/ce0e6938e2c8aa7a093b16e80373dccf", "content": "## \ud83d\udd17 Companion release\n\nNo open **Marketplace-client (frontend)** release PR found yet \u2014 it will be linked automatically once it exists.\n\n- https://github.com/Wishibam/Marketplace-client/pulls?q=is%3Apr+is%3Aopen+base%3Amaster+head%3Adevelop\n\n- **Misc**\n - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)", "creation_timestamp": "2026-08-06T14:59:38.220856Z"} https://vulnerability.circl.lu/sighting/dcf5ec43-cd89-48fd-8652-f370ff704b88/export Thu, 06 Aug 2026 14:59:38 +0000 https://vulnerability.circl.lu/sighting/3b9d311b-1849-42c6-bf72-2e5a90c93bc0/export {"uuid": "3b9d311b-1849-42c6-bf72-2e5a90c93bc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/a87a156132d4ce3d4d952e21a796220a", "content": "## \ud83d\udd17 Companion release\n\nNo open **Marketplace-client (frontend)** release PR found yet \u2014 it will be linked automatically once it exists.\n\n- https://github.com/Wishibam/Marketplace-client/pulls?q=is%3Apr+is%3Aopen+base%3Amaster+head%3Adevelop\n\n- **Misc**\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)", "creation_timestamp": "2026-08-06T14:00:28.557002Z"} {"uuid": "3b9d311b-1849-42c6-bf72-2e5a90c93bc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/a87a156132d4ce3d4d952e21a796220a", "content": "## \ud83d\udd17 Companion release\n\nNo open **Marketplace-client (frontend)** release PR found yet \u2014 it will be linked automatically once it exists.\n\n- https://github.com/Wishibam/Marketplace-client/pulls?q=is%3Apr+is%3Aopen+base%3Amaster+head%3Adevelop\n\n- **Misc**\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)", "creation_timestamp": "2026-08-06T14:00:28.557002Z"} https://vulnerability.circl.lu/sighting/3b9d311b-1849-42c6-bf72-2e5a90c93bc0/export Thu, 06 Aug 2026 14:00:28 +0000