CVE-2026-68500 Sylius Mollie Plugin: Payment status forgery via the payment webhook

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /locale/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the...

GHSA-VW27-FWJF-5QXM

creationtimestamp| type| source ---|---|--- 2026-07-30 16:49:48+00:00| seen| https://gist.github.com/tu-trinh-scale/6952882fc494bc673397ec58f04a6e92 2026-07-30 19:33:36+00:00| seen| https://gist.github.com/tu-trinh-scale/cdec105f804c8b4962d64774b7f2237d 2026-07-30 19:33:48+00:00| seen|...

SUSE CVE-2026-47124

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.9, any authenticated non-admin member can connect to the server-status WebSocket and receive telemetry for all servers, including servers owned by other users...

SUSE CVE-2026-48154

unknown...

SUSE CVE-2026-50149

unknown...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the traceevents.createTracing.enable function. An attacker can write trace logs outside the intended file system boundaries by exploiting insufficient enforcement of the permission model. Remediation A fix wa...

CVE-2026-5582

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...

EUVD-2026-51096

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...

CVE-2026-5582 FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...

CVE-2026-67248

creationtimestamp| type| source ---|---|--- 2026-07-30 06:45:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/23bhethvirrjs 2026-08-04 14:26:13+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msb7rxlqal2c...

GHSA-PM5P-7W5H-JM5Q

creationtimestamp| type| source ---|---|--- 2026-07-30 06:31:29+00:00| seen| https://gist.github.com/alon710/5f2d10f3a54edb2e4c4f46ec9659b74e...

CVE-2026-15054

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows such as email notifications of forms the site owner has deactivated or...

CVE-2026-13178

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

CVE-2026-13178 Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

CVE-2026-13178

CVE-2026-13178 affects the Eventin WordPress plugin, prior to version 4.1.16. The vulnerability allows unauthenticated attackers to create orders and set an attacker-controlled order status, resulting in orders being marked as paid without real payment completion. This stems from improper authori...

EUVD-2026-51009

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

CVE-2026-13178 Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

CVE-2026-13143

The CVE-2026-13143 entry concerns the WP Travel WordPress plugin before 11.8.1. Vulnerability: it does not verify PayPal Instant Payment Notifications via the PayPal post-back handshake before marking a booking as paid, enabling an unauthenticated actor to forge a notification that flips any pend...

CVE-2026-15054

The CVE-2026-15054 entry concerns the Bit Form WordPress plugin (pre-3.1.2). The vulnerability arises because the public form-submission handlers do not enforce a form’s active/published status, allowing unauthenticated users to submit entries to and trigger configured workflows (e.g., email noti...

CVE-2026-48448

creationtimestamp| type| source ---|---|--- 2026-07-30 04:00:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrtki7wira23 2026-08-01 11:00:24+00:00| seen| https://bsky.app/profile/hendryadrian.bsky.social/post/3mrzcv5vr7s2e 2026-08-04 11:12:11+00:00| seen|...