GHSA-336W-HGPQ-6369

creationtimestamp| type| source ---|---|--- 2026-02-02 12:10:51+00:00| seen| https://gist.github.com/alon710/d39f573efb957757ba7be655034c3074...

PT-2026-5744

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1 Description Craft Commerce is susceptible to a stored cross-site scripting XSS issue within the Order Status History Message functionality. The system...

PT-2026-6293

Name of the Vulnerable Software and Affected Versions Craft Commerce versions 4.0.0-RC1 through 4.10.0 Craft Commerce versions 5.0.0 through 5.5.1 Description A stored DOM Cross-Site Scripting XSS issue exists within the "Recent Orders" dashboard widget. The Order Status Name is rendered using...

Linux Distros Unpatched Vulnerability : CVE-2026-24825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing Release of Memory after Effective Lifetime vulnerability in ydb-platform ydb contrib/libs/yajl modules. This vulnerability is associated with program...

PT-2026-6417

Summary A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. Users are recommended to update to the patched 5.5.2...

MINI-XG2F-HG8P-M6W4

Bulletin has no description...

CVE-2025-134655

creationtimestamp| type| source ---|---|--- 2026-01-31 17:04:20+00:00| seen| https://bsky.app/profile/pigondrugs.bsky.social/post/3mdqcedfvbt2y...

CVE-2026-1165

The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publishunpublishpopupbox' function that verifies a self-created nonce rather than one submitted in the request. This mak...

CVE-2026-1165 Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change

The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publishunpublishpopupbox' function that verifies a self-created nonce rather than one submitted in the request. This mak...

CVE-2026-1165

The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publishunpublishpopupbox' function that verifies a self-created nonce rather than one submitted in the request. This mak...

GHSA-JFPC-WJ3M-QW2M

creationtimestamp| type| source ---|---|--- 2026-01-31 01:20:51+00:00| seen| https://gist.github.com/alon710/6005675fc930251c9d8000c9e9ab7e40...

GHSA-6JR7-99PF-8VGF

creationtimestamp| type| source ---|---|--- 2026-01-30 23:20:42+00:00| seen| Telegram/pazjypwJ9q5j0AUml5NqFL8eGc5J3hEHdG482ywyT6Ic5U0...

GHSA-28QQ-5F47-R5X2

creationtimestamp| type| source ---|---|--- 2026-01-30 19:05:02+00:00| seen| https://infosec.exchange/users/DarkWebInformer/statuses/115985606322071908...

Allocation of Resources Without Limits or Throttling

Overview io.undertow:undertow-core is a Java web server based on non-blocking IO. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the getParameterNames function. An attacker can cause an OutOfMemoryError by sending requests with...

TikTok’s privacy update mentions immigration status. Here’s why.

In 2026, could any five words be more chilling than “We’re changing our privacy terms?” The timing could not have been worse for TikTok US when it sent millions of US users a mandatory privacy pop-up on January 22. The message forced users to accept updated terms if they wanted to keep using the...

CERTFR-2026-ALE-001

creationtimestamp| type| source ---|---|--- 2026-01-30 11:02:01+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115983706971608725...

UBUNTU-CVE-2026-25061

tcpflow is a TCP/IP packet demultiplexer. In versions up to and including 1.61, wifipcap parses 802.11 management frame elements and performs a length check on the wrong field when handling the TIM element. A crafted frame with a large TIM length can cause a 1-byte out-of-bounds write past...

GHSA-M3H4-65J5-6J8C

creationtimestamp| type| source ---|---|--- 2026-01-29 20:49:13+00:00| seen| https://infosec.exchange/users/DarkWebInformer/statuses/115980353620259404...

CVE-2026-1637

creationtimestamp| type| source ---|---|--- 2026-01-29 19:41:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115980086235727489 2026-01-30 02:05:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdm7ny4xlv2t...

CVE-2026-1060

The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permissioncallback set to returntrue, allowing unauthenticated attacke...