Where
-Infinity
0

Trending

Last week
Last month
Last year

composer/craftcms/commerceCraft Commerce has a Potential IDOR in Commerce carts

Risk 27
Severity
6.3
EPSS
0.05%
First published (updated )
CVE-2026-31867

composer/craftcms/commerceCraft Commerce has Stored XSS in Craft Commerce Order Details Slideout

Risk 25
Severity
5.4
EPSS
0.01%
First published (updated )
CVE-2026-29177

composer/craftcms/commerceCraft Commerce has Stored XSS in Inventory Location Name

Risk 23
Severity
4.8
EPSS
0.01%
First published (updated )
CVE-2026-29176

composer/craftcms/commerceMultiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking

Risk 49
Severity
8.6
EPSS
0.03%
First published (updated )
CVE-2026-29175

composer/craftcms/commerceCraft Commerce has a SQL Injection in Commerce Inventory Table Sorting

Risk 56
Severity
8.8
EPSS
0.01%
First published (updated )
CVE-2026-29174
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/craftcms/commerceCraft Commerce has Stored XSS while updating Order Status from Orders Table

Risk 16
Severity
4.8
EPSS
0.01%
First published (updated )
CVE-2026-29173

composer/craftcms/commerceCraft Commerce has a SQL Injection in Commerce Purchasables Table Sorting

Risk 56
Severity
8.8
EPSS
0.03%
First published (updated )
CVE-2026-29172

composer/craftcms/commerceCraft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation

Risk 32
Severity
6.1
EPSS
0.02%
First published (updated )
CVE-2026-25522

CraftCMS Craft Commerce Craft CmsCraft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation

Risk 32
Severity
6.1
EPSS
0.01%
First published (updated )
CVE-2026-25490

CraftCMS Craft Commerce Craft CmsCraft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation

Risk 32
Severity
6.1
EPSS
0.01%
First published (updated )
CVE-2026-25489
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

CraftCMS Craft Commerce Craft CmsCraft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation

Risk 32
Severity
6.1
EPSS
0.04%
First published (updated )
CVE-2026-25488

CraftCMS Craft Commerce Craft CmsCraft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation

Risk 32
Severity
6.1
EPSS
0.04%
First published (updated )
CVE-2026-25487

composer/craftcms/commerceCraft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation

Risk 32
Severity
6.1
EPSS
0.03%
First published (updated )
CVE-2026-25486

CraftCMS Craft Commerce Craft CmsCraft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation

Risk 38
Severity
6.2
EPSS
0.01%
First published (updated )
CVE-2026-25485

CraftCMS Craft Commerce Craft CmsCraft Commerce has Stored XSS in Product Type Name

Risk 23
Severity
4.8
EPSS
0.01%
First published (updated )
CVE-2026-25484
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

CraftCMS Craft Commerce Craft CmsCraft Commerce has Stored XSS via Order Status Message with potential database exfiltration

Risk 33
Severity
6.2
EPSS
0.01%
First published (updated )
CVE-2026-25483

CraftCMS Craft Commerce Craft CmsCraft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

Risk 38
Severity
6.2
EPSS
0.01%
First published (updated )
CVE-2026-25482

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203