WordPress FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle vulnerability

Cross-Site Request Forgery to Sync Rule Status Toggle vulnerability discovered by Deadbee in WordPress Plugin FuseWP versions = 1.1.24.2...

CVE-2026-51259

creationtimestamp| type| source ---|---|--- 2026-07-28 19:14:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrq4mb5ppf2k...

CVE-2026-48395

creationtimestamp| type| source ---|---|--- 2026-07-28 18:47:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrq35d7c4r23 2026-07-29 12:04:45+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mrrv3heowi2d 2026-08-05 20:37:06+00:00| seen|...

SUSE CVE-2026-58216

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

SUSE CVE-2026-59643

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

CVE-2026-61609

creationtimestamp| type| source ---|---|--- 2026-07-28 16:35:05+00:00| published-proof-of-concept| https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47 2026-07-28 17:01:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrpv6ijm6f2o...

GHSA-HC4M-Q9JH-XW4J

creationtimestamp| type| source ---|---|--- 2026-07-28 16:31:30+00:00| seen| https://gist.github.com/alon710/92ad6f547c2ba0c3ac7a937f90c439cc...

MINI-XGC7-3HX5-4M8H

Bulletin has no description...

MINI-XFX9-HM6R-VJ52

Bulletin has no description...

MINI-XMG8-F3QM-VF2J

Bulletin has no description...

MINI-H6W5-3HGV-4Q7F

Bulletin has no description...

CVE-2026-62436

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

MINI-V8QG-CM59-FH55

Bulletin has no description...

CVE-2026-18029

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-18029

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-18029 Insufficient validation of payment status in pretix-girosolution

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-18029

The CVE-2026-18029 entry is tied to the pretix-girosolution payment integration. Affected component: payment status validation in GiroCheckout flow. Root cause: insufficient validation of payment status responses, enabling an attacker to reuse a successful status for one payment with a different ...

EUVD-2026-49752

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-18029 Insufficient validation of payment status in pretix-girosolution

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-57213

A flaw was found in the RabbitMQ rabbitmqfederationmanagement plugin. This cross-site scripting XSS vulnerability occurs because the consumertag field on the Federation Status page does not properly escape HTML. A user with permissions to configure a federation upstream or policy can exploit this...