CVE-2026-27842

creationtimestamp| type| source ---|---|--- 2026-03-11 05:00:00+00:00| seen| https://jvn.jp/en/vu/JVNVU98103854/ 2026-03-11 06:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116209013884304793 2026-03-16 03:00:08+00:00| seen|...

CVE-2026-30966

creationtimestamp| type| source ---|---|--- 2026-03-11 03:00:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116208306034086488 2026-03-12 07:40:47+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mgtvji7he42y...

CVE-2026-23813

creationtimestamp| type| source ---|---|--- 2026-03-11 03:00:15+00:00| seen| https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05027enus&docLocale=enUS 2026-03-11 03:00:21+00:00| seen|...

CVE-2026-21361

creationtimestamp| type| source ---|---|--- 2026-03-11 02:15:56+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-21361 2026-03-17 13:00:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhazpbyfrq24 2026-03-22 09:10:02+00:00| seen|...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure in the /verificationEmailRequest endpoint. An attacker can determine whether specific email addresses a...

CVE-2026-28806

creationtimestamp| type| source ---|---|--- 2026-03-11 00:00:43+00:00| seen| https://infosec.exchange/users/offseq/statuses/116207599051092008...

Linux Distros Unpatched Vulnerability : CVE-2026-31958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in...

CVE-2026-0124

creationtimestamp| type| source ---|---|--- 2026-03-10 23:32:36+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116207488529362845 2026-03-11 01:30:41+00:00| seen| https://infosec.exchange/users/offseq/statuses/116207951967793276...

CVE-2025-48611

creationtimestamp| type| source ---|---|--- 2026-03-10 23:19:18+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116207435885278449 2026-03-17 07:49:22+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mhaidgdbzo27 2026-03-30 16:00:15+00:00| seen|...

GHSA-QMW5-2P58-XVRC

creationtimestamp| type| source ---|---|--- 2026-03-10 21:40:05+00:00| seen| https://gist.github.com/alon710/c10cdbd73c5cbd65710762162e90e072...

CVE-2026-29173

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...

MINI-8X5R-W37Q-WJXR

Bulletin has no description...

CVE-2026-29173 Craft Commerce has Stored XSS while updating Order Status from Orders Table

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...

CVE-2026-29173 Craft Commerce has Stored XSS while updating Order Status from Orders Table

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...

CVE-2026-29173 Craft Commerce has Stored XSS while updating Order Status from Orders Table

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...

CVE-2026-29173

Craft Commerce (for Craft CMS) has a stored XSS vulnerability that affects the Order Status name field when updating the status from the Commerce Orders Table. The issue occurs prior to versions 4.10.2 and 5.5.3, where the Status Name is rendered without proper escaping, enabling script execution...

CVE-2026-29173

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...

EUVD-2026-10815

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...

GO-2026-4613 Gokapi has Data Leak in Upload Status Stream in github.com/forceu/gokapi

Gokapi has Data Leak in Upload Status Stream in github.com/forceu/gokapi. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

Authorization Bypass Through User-Controlled Key

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the number parameter in the cart loading process. An attacker can gain unauthorized access to and modify another user's shopping cart by...