CVE-2026-106599

{
  "etk_id": "ETK-2026-1576",
  "cve_id": "CVE-2026-106599",
  "display_id": "CVE-2026-106599",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-101010",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe deserialization in SureCart",
  "summary": "SureCart versions through 4.9.3 are affected by unsafe deserialization that can allow object injection. An attacker with the required authenticated access may be able to exploit the issue and affect the site's confidentiality, integrity, or availability.",
  "mitigation": "Restrict SureCart administrative and authenticated access to trusted users, and disable the plugin where it is not required. Monitor for and apply a vendor update that addresses this issue when one is released.",
  "vendor": "Brainstorm Force",
  "product": "SureCart",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 4.9.3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "surecart",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0042,
  "epss_percentile": 0.3493,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 52.07721086666667,
  "t0_at": "2026-10-14T12:08:27.048000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-14T14:45:20.957203+00:00",
      "days": 0.10895728244212963,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T12:08:27.048000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-14T12:08:27.048000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T12:08:27.048000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106599"
    }
  }
}