Open5GS 安全漏洞

Open5GS is an open-source implementation of 5G Core and EPC in C language, which serves as the core network for Lte/Nr networks. Versions of Open5GS 2.7.7 and earlier contain security vulnerabilities. These vulnerabilities stem from the operation of the parameter ueContextId in the function...

PT-2026-36262

Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.8 Description A remote denial of service can be triggered by manipulating the ueContextId argument in the '/namf-comm/v1/ue-contexts/ueContextId/transfer-update' endpoint. This issue resides within the amf namf co...

CVE-2026-3488 WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation

The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.16.4. This is due to missing capability checks on multiple AJAX handlers including wpstatisticsgetfilters, wpstatisticsgetPrivacyStatus, wpstatisticsupdatePrivacyStatus, and...

CVE-2026-20930

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 17:28:34+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116404238027819761 2026-04-14 20:03:36+00:00|...

CVE-2026-35385

creationtimestamp| type| source ---|---|--- 2026-04-02 17:18:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116336249196256275 2026-04-02 18:09:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijsgdr42e2t 2026-04-02 18:24:22+00:00| seen|...

CVE-2026-31853

creationtimestamp| type| source ---|---|--- 2026-03-30 07:02:33+00:00| seen| https://infosec.exchange/users/certvde/statuses/116316841599408182...

CVE-2026-29173

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...

CVE-2026-33143

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the WhatsApp POST webhook handler /notification/whatsapp/webhook processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowing any...

CVE-2026-22322

creationtimestamp| type| source ---|---|--- 2026-03-18 07:16:30+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-22322 2026-03-18 07:36:35+00:00| seen| https://infosec.exchange/users/certvde/statuses/116249027843473696...

CVE-2026-4227

creationtimestamp| type| source ---|---|--- 2026-03-16 12:01:05+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116238743317716735 2026-03-21 03:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhk4bi22lq2a...

CVE-2025-15473 Timetics < 1.0.52 - Unauthenticated Payment/Booking Status Update

The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type...

CVE-2026-29173

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...

CVE-2026-29173 Craft Commerce has Stored XSS while updating Order Status from Orders Table

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...

CVE-2026-29173 Craft Commerce has Stored XSS while updating Order Status from Orders Table

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...

CVE-2026-26111

creationtimestamp| type| source ---|---|--- 2026-03-10 16:57:37+00:00| seen| https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review 2026-03-10 19:02:37+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116206426958203363 2026-03-10 19:07:55+00:00| seen|...

PT-2026-24415

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...

CVE-2026-3769

creationtimestamp| type| source ---|---|--- 2026-03-08 08:15:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116192556598077213 2026-03-08 20:15:51+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3769 2026-03-09 01:30:27+00:00| seen|...

CVE-2026-23234

creationtimestamp| type| source ---|---|--- 2026-03-04 15:10:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116171539246167027 2026-03-04 16:12:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgaof534oe2n 2026-03-13 00:00:00+00:00| seen|...

CVE-2025-12356 Tickera – WordPress Event Ticketing <= 3.5.6.4 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxchangeticketstatus' AJAX endpoint in all versions up to, and including, 3.5.6.4. This makes it possible for authenticated attackers,...

WordPress Tickera - WordPress Event Ticketing plugin <= 3.5.6.4 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update vulnerability

WordPress Tickera - WordPress Event Ticketing plugin = 3.5.6.4 - Missing Authorization to Authenticated Subscriber+ Event/Post Status Update vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Tickera versions = 3.5.6.4...