CVE-2026-121628Low· 3.7▾ TwilightPoC availableBagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage ord…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 20.4 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.
bagisto < 2.3.16bagisto >= 2.4.0 < 2.4.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121733Medium· 5.4Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload
CVE-2026-101139Low· 2.7A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4
CVE-2023-42756Medium· 4.4Kernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swap
CVE-2026-10565Low· 3.1Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition
CVE-2026-100394Medium· 6.5Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool
CVE-2022-3635Medium· 5.5A vulnerability, which was classified as critical, has been found in Linux Kernel