CVE-2025-67853

creationtimestamp| type| source ---|---|--- 2026-02-03 11:23:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdxaot376d2m...

CVE-2026-25514

creationtimestamp| type| source ---|---|--- 2026-02-03 10:38:35+00:00| published-proof-of-concept| https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-pqqg-5f4f-8952...

CVE-2026-0617

creationtimestamp| type| source ---|---|--- 2026-02-03 09:17:08+00:00| seen| Telegram/FqzbYeVrA83bKBXihn9RsWwSkEuF36kvwdGphoUN0o5eRo...

CVE-2026-24932

creationtimestamp| type| source ---|---|--- 2026-02-03 05:15:48+00:00| seen| Telegram/6dqf89PpLpfc9u5war90qHxaQJlIkUtwZabucX5NXjJD9U...

CVE-2026-20406

creationtimestamp| type| source ---|---|--- 2026-02-03 01:23:33+00:00| seen| Telegram/-UDXMrilYDrJxWwjNCqjzO-ukW8c0GFIIqTDgVj56skRNA...

VulnCheck KEV: CVE-2024-12877

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possible for unauthenticated attackers to...

PT-2026-5965

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description A flaw exists in Moodle where user identifiers are exposed in URLs during anonymous assignment submissions. This exposure compromises the intended anonymity and could lead to information...

GHSA-8478-RMJG-MJJ5 Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration

Summary A stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions which do not require an elevated session, an...

Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration

Summary A stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions which do not require an elevated session, an...

GHSA-FRJ9-9RWC-PW9J Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

Summary A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. Users are recommended to update to the patched 5.5.2...

Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

Summary A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. Users are recommended to update to the patched 5.5.2...

WordPress Popup Box plugin <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change vulnerability

Cross-Site Request Forgery to Popup Status Change vulnerability discovered by w41bu1 - VNPT Cyber Immunity in WordPress Plugin Popup box versions = 6.1.1...

GHSA-336W-HGPQ-6369

creationtimestamp| type| source ---|---|--- 2026-02-02 12:10:51+00:00| seen| https://gist.github.com/alon710/d39f573efb957757ba7be655034c3074...

Linux Distros Unpatched Vulnerability : CVE-2026-24825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing Release of Memory after Effective Lifetime vulnerability in ydb-platform ydb contrib/libs/yajl modules. This vulnerability is associated with program...

PT-2026-5744

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1 Description Craft Commerce is susceptible to a stored cross-site scripting XSS issue within the Order Status History Message functionality. The system...

PT-2026-6417

Summary A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. Users are recommended to update to the patched 5.5.2...

PT-2026-6293

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1 Description A stored DOM Cross-Site Scripting XSS issue exists within the "Recent Orders" dashboard widget. The Order Status Name is rendered using...

MINI-XG2F-HG8P-M6W4

Bulletin has no description...

CVE-2025-134655

creationtimestamp| type| source ---|---|--- 2026-01-31 17:04:20+00:00| seen| https://bsky.app/profile/pigondrugs.bsky.social/post/3mdqcedfvbt2y...

CVE-2026-1165

The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publishunpublishpopupbox' function that verifies a self-created nonce rather than one submitted in the request. This mak...