CVE-2026-29173: Improper Neutralization of Input During Web Page Generation

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...

PT-2026-24415

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...

CVE-2026-28431

creationtimestamp| type| source ---|---|--- 2026-03-09 22:30:13+00:00| seen| https://infosec.exchange/users/offseq/statuses/116201580941905093...

GHSA-93FX-5QGC-WR38

creationtimestamp| type| source ---|---|--- 2026-03-09 20:10:06+00:00| seen| https://gist.github.com/alon710/56622a5fb0d29db6ad09ba417d4e4cd3...

CVE-2026-3638

creationtimestamp| type| source ---|---|--- 2026-03-09 19:30:13+00:00| seen| https://infosec.exchange/users/offseq/statuses/116200873186129950...

GHSA-HWX8-Q9CG-MQMC

creationtimestamp| type| source ---|---|--- 2026-03-09 19:10:06+00:00| seen| https://gist.github.com/alon710/3fd4142edf95384fd65face73227a201...

GHSA-Q5Q9-2RHP-33QW

creationtimestamp| type| source ---|---|--- 2026-03-09 18:40:05+00:00| seen| https://gist.github.com/alon710/b35bd22da36673db291bcd39a01cd730...

CVE-2025-70238

creationtimestamp| type| source ---|---|--- 2026-03-09 16:12:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116200094574895659...

CVE-2025-15547

creationtimestamp| type| source ---|---|--- 2026-03-09 12:22:34+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116199191644869912...

CVE-2026-30829

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to version 3.4.0, an unauthenticated information disclosure vulnerability exists in the GET /api/v1/status-page/:url...

CVE-2025-70037

creationtimestamp| type| source ---|---|--- 2026-03-09 05:48:15+00:00| seen| https://gist.github.com/zcxlighthouse/0ca0e8750ad14964fa0ce24137ed346d 2026-03-09 16:16:11+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2025-70037...

CVE-2026-3630

creationtimestamp| type| source ---|---|--- 2026-03-09 03:15:58+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3630 2026-03-09 04:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116197335245358042 2026-03-09 07:12:12+00:00| seen|...

PT-2026-36386

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The dt2815 driver crashes when attached to I/O ports without actual hardware present. This occurs because users can attach the driver to arbitrary I/O addresses via the 'COMEDI DEVCONFIG...

CVE-2026-3768

creationtimestamp| type| source ---|---|--- 2026-03-08 20:15:51+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3768 2026-03-09 03:00:35+00:00| seen| https://infosec.exchange/users/offseq/statuses/116196981604748824...

CVE-2026-3811

creationtimestamp| type| source ---|---|--- 2026-03-08 16:34:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116194520293691515 2026-03-09 09:00:33+00:00| seen| https://infosec.exchange/users/offseq/statuses/116198397192514880...

CVE-2026-3729

creationtimestamp| type| source ---|---|--- 2026-03-08 08:28:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116192609218289179 2026-03-08 10:15:49+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3729...

CVE-2026-3769

creationtimestamp| type| source ---|---|--- 2026-03-08 08:15:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116192556598077213 2026-03-08 20:15:51+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3769 2026-03-09 01:30:27+00:00| seen|...

org.webjars.npm:g-status (2.0.2), org.webjars.npm:graphql-toolkit__git-loader (0.7.5) potentially affected by CVE-2022-25912 +1 more via org.webjars.npm:simple-git (>=1.129.0, <=1.132.0)

org.webjars.npm:simple-git MAVEN version =1.129.0, =1.132.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:simple-git and may be impacted: - org.webjars.npm:g-status 2.0.2 - org.webjars.npm:graphql-toolkitgit-loader 0.7.5 Source cves:...

CVE-2026-30831

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities exist in Rocket.Chat's enterprise DDP Streamer service. The Account.login method exposed through the DDP...

CVE-2026-2754

Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with network access to the device can execute HTTP GET requests to TCP port 8080 to retrieve internal network parameters including ECDIS & OT...