24694 matches found
SUSE CVE-2026-48154
GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and...
SUSE CVE-2026-50149
unknown...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via the traceevents.createTracing.enable function. An attacker can write trace logs outside the intended file system boundaries by exploiting insufficient enforcement of the permission model. Remediation A fix wa...
CVE-2026-5582
The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...
EUVD-2026-51096
The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...
CVE-2026-5582 FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle
The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...
GHSA-M4X6-GWGP-4PM7
creationtimestamp| type| source ---|---|--- 2026-07-30 09:32:05+00:00| seen| https://gist.github.com/alon710/7771115a3d9e03361e58ecd1b540d28d...
CVE-2026-67248
creationtimestamp| type| source ---|---|--- 2026-07-30 06:45:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/23bhethvirrjs 2026-08-04 14:26:13+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msb7rxlqal2c 2026-08-05 17:37:06+00:00| seen|...
GHSA-PM5P-7W5H-JM5Q
creationtimestamp| type| source ---|---|--- 2026-07-30 06:31:29+00:00| seen| https://gist.github.com/alon710/5f2d10f3a54edb2e4c4f46ec9659b74e...
CVE-2026-15054
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows such as email notifications of forms the site owner has deactivated or...
CVE-2026-13178
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...
CVE-2026-13143
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at ...
CVE-2026-13178
CVE-2026-13178 affects the Eventin WordPress plugin, prior to version 4.1.16. The vulnerability allows unauthenticated attackers to create orders and set an attacker-controlled order status, resulting in orders being marked as paid without real payment completion. This stems from improper authori...
CVE-2026-13178 Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...
CVE-2026-13178
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...
CVE-2026-13178 Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...
EUVD-2026-51009
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...
CVE-2026-13143
The CVE-2026-13143 entry concerns the WP Travel WordPress plugin before 11.8.1. Vulnerability: it does not verify PayPal Instant Payment Notifications via the PayPal post-back handshake before marking a booking as paid, enabling an unauthenticated actor to forge a notification that flips any pend...
CVE-2026-15054
The CVE-2026-15054 entry concerns the Bit Form WordPress plugin (pre-3.1.2). The vulnerability arises because the public form-submission handlers do not enforce a form’s active/published status, allowing unauthenticated users to submit entries to and trigger configured workflows (e.g., email noti...
CVE-2026-48448
creationtimestamp| type| source ---|---|--- 2026-07-30 04:00:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrtki7wira23 2026-08-01 11:00:24+00:00| seen| https://bsky.app/profile/hendryadrian.bsky.social/post/3mrzcv5vr7s2e 2026-08-04 11:12:11+00:00| seen|...