GHSA-8478-RMJG-MJJ5 Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration

Summary A stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions which do not require an elevated session, an...

Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration

Summary A stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions which do not require an elevated session, an...

Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

Summary A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. Users are recommended to update to the patched 5.5.2...

GHSA-FRJ9-9RWC-PW9J Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

Summary A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. Users are recommended to update to the patched 5.5.2...

WordPress Popup Box plugin <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change vulnerability

Cross-Site Request Forgery to Popup Status Change vulnerability discovered by w41bu1 - VNPT Cyber Immunity in WordPress Plugin Popup box versions = 6.1.1...

GHSA-336W-HGPQ-6369

creationtimestamp| type| source ---|---|--- 2026-02-02 12:10:51+00:00| seen| https://gist.github.com/alon710/d39f573efb957757ba7be655034c3074...

PT-2026-6293

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1 Description A stored DOM Cross-Site Scripting XSS issue exists within the "Recent Orders" dashboard widget. The Order Status Name is rendered using...

PT-2026-6417

Summary A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. Users are recommended to update to the patched 5.5.2...

PT-2026-5744

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1 Description Craft Commerce is susceptible to a stored cross-site scripting XSS issue within the Order Status History Message functionality. The system...

Linux Distros Unpatched Vulnerability : CVE-2026-24825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing Release of Memory after Effective Lifetime vulnerability in ydb-platform ydb contrib/libs/yajl modules. This vulnerability is associated with program...

MINI-XG2F-HG8P-M6W4

Bulletin has no description...

CVE-2025-134655

creationtimestamp| type| source ---|---|--- 2026-01-31 17:04:20+00:00| seen| https://bsky.app/profile/pigondrugs.bsky.social/post/3mdqcedfvbt2y...

CVE-2026-1165

The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publishunpublishpopupbox' function that verifies a self-created nonce rather than one submitted in the request. This mak...

CVE-2026-1165 Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change

The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publishunpublishpopupbox' function that verifies a self-created nonce rather than one submitted in the request. This mak...

CVE-2026-1165

The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publishunpublishpopupbox' function that verifies a self-created nonce rather than one submitted in the request. This mak...

GHSA-JFPC-WJ3M-QW2M

creationtimestamp| type| source ---|---|--- 2026-01-31 01:20:51+00:00| seen| https://gist.github.com/alon710/6005675fc930251c9d8000c9e9ab7e40...

GHSA-6JR7-99PF-8VGF

creationtimestamp| type| source ---|---|--- 2026-01-30 23:20:42+00:00| seen| Telegram/pazjypwJ9q5j0AUml5NqFL8eGc5J3hEHdG482ywyT6Ic5U0...

GHSA-28QQ-5F47-R5X2

creationtimestamp| type| source ---|---|--- 2026-01-30 19:05:02+00:00| seen| https://infosec.exchange/users/DarkWebInformer/statuses/115985606322071908...

Allocation of Resources Without Limits or Throttling

Overview io.undertow:undertow-core is a Java web server based on non-blocking IO. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the getParameterNames function. An attacker can cause an OutOfMemoryError by sending requests with...

TikTok’s privacy update mentions immigration status. Here’s why.

In 2026, could any five words be more chilling than “We’re changing our privacy terms?” The timing could not have been worse for TikTok US when it sent millions of US users a mandatory privacy pop-up on January 22. The message forced users to accept updated terms if they wanted to keep using the...