24670 matches found
Information Exposure
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure in the /verificationEmailRequest endpoint. An attacker can determine whether specific email addresses a...
CVE-2026-28806
creationtimestamp| type| source ---|---|--- 2026-03-11 00:00:43+00:00| seen| https://infosec.exchange/users/offseq/statuses/116207599051092008...
Linux Distros Unpatched Vulnerability : CVE-2026-31958
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in...
CVE-2026-0124
creationtimestamp| type| source ---|---|--- 2026-03-10 23:32:36+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116207488529362845 2026-03-11 01:30:41+00:00| seen| https://infosec.exchange/users/offseq/statuses/116207951967793276...
CVE-2025-48611
creationtimestamp| type| source ---|---|--- 2026-03-10 23:19:18+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116207435885278449 2026-03-17 07:49:22+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mhaidgdbzo27 2026-03-30 16:00:15+00:00| seen|...
GHSA-QMW5-2P58-XVRC
creationtimestamp| type| source ---|---|--- 2026-03-10 21:40:05+00:00| seen| https://gist.github.com/alon710/c10cdbd73c5cbd65710762162e90e072...
CVE-2026-29173
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...
MINI-8X5R-W37Q-WJXR
Bulletin has no description...
CVE-2026-29173 Craft Commerce has Stored XSS while updating Order Status from Orders Table
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...
CVE-2026-29173 Craft Commerce has Stored XSS while updating Order Status from Orders Table
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...
EUVD-2026-10815
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...
CVE-2026-29173
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...
CVE-2026-29173
Craft Commerce (for Craft CMS) has a stored XSS vulnerability that affects the Order Status name field when updating the status from the Commerce Orders Table. The issue occurs prior to versions 4.10.2 and 5.5.3, where the Status Name is rendered without proper escaping, enabling script execution...
CVE-2026-29173 Craft Commerce has Stored XSS while updating Order Status from Orders Table
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...
GO-2026-4613 Gokapi has Data Leak in Upload Status Stream in github.com/forceu/gokapi
Gokapi has Data Leak in Upload Status Stream in github.com/forceu/gokapi. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
Authorization Bypass Through User-Controlled Key
Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the number parameter in the cart loading process. An attacker can gain unauthorized access to and modify another user's shopping cart by...
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table
Summary A stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. --- Proof of Concept Required Permissions - Admin access to edit/create Order...
EUVD-2026-10814
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table...
GHSA-MQXF-2998-C6CP Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table
Summary A stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. --- Proof of Concept Required Permissions - Admin access to edit/create Order...