72 matches found
CVE-2026-119421
Juspay Hyperswitch through 1.128.0 and builds before 2026.10.19.0 contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any clientsecret via POST /payouts/payoutid/confirm. Attackers holding the merchant's publishable key and a payoutid can...
CVE-2026-119421 Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation
Juspay Hyperswitch through 1.128.0 and builds before 2026.10.19.0 contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any clientsecret via POST /payouts/payoutid/confirm. Attackers holding the merchant's publishable key and a payoutid can...
CVE-2026-119421
The Juspay Hyperswitch platform (versions through 1.128.0 and builds before 2026.10.19.0 ) is susceptible to a missing authorization vulnerability (CWE-639). An unauthenticated attacker possessing a merchant's publishable key and a payout_id can perform a POST request to /payouts/{payout_id}/conf...
EUVD-2026-113801
Juspay Hyperswitch through 1.128.0 and builds before 2026.10.19.0 contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any clientsecret via POST /payouts/payoutid/confirm. Attackers holding the merchant's publishable key and a payoutid can...
CVE-2026-119421 Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation
Juspay Hyperswitch through 1.128.0 and builds before 2026.10.19.0 contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any clientsecret via POST /payouts/payoutid/confirm. Attackers holding the merchant's publishable key and a payoutid can...
CVE-2026-119421 Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation
Juspay Hyperswitch through 1.128.0 and builds before 2026.10.19.0 contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any clientsecret via POST /payouts/payoutid/confirm. Attackers holding the merchant's publishable key and a payoutid can...
PT-2026-133474
Juspay Hyperswitch through 1.128.0 and builds before 2026.10.19.0 contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client secret via POST /payouts/payout id/confirm. Attackers holding the merchant's publishable key and a payout id ca...
CVE-2026-119421: juspay hyperswitch: Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that…
Juspay Hyperswitch through 1.128.0 and builds before 2026.10.19.0 contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any clientsecret via POST /payouts/payoutid/confirm. Attackers holding the merchant's publishable key and a payoutid can...
DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
The operators of the DevMan ransomware-as-a-service RaaS scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims. Swiss cybersecurity company PRODAFT is tracking the centrally administere...
GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier
Beginning July 27, 2026, GitHub will cut public bug bounty payouts by at least half at every severity level. Critical findings will drop from $20,000-$30,000+ to a fixed $10,000, while its permanent invite-only VIP tier will pay $30,000 or more. Reports filed before that date, including those...
Next chapter: Restructuring GitHub’s bug bounty program
The security research community makes GitHub safer for everyone. That's the simple idea behind our bug bounty program. For more than a decade, researchers from around the world have helped us find and fix vulnerabilities before they could be exploited, and we've worked hard to be a program worth...
Felons, Fraudsters Flog Offensive Cybersecurity Startup
A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convicted felons whose most recent ventures included fake intelligence companies and a now-defunct AI-based lobbying platfor...
Best Crypto Payment Solutions for E-Commerce Businesses
Compare crypto payment gateways for ecommerce, including checkout tools, stablecoin payments, fiat settlement, plugins, APIs and business payouts...
Malware in paypal-payouts-bridge
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious Package
Overview paypal-payouts-bridge is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Pwn2Own Berlin 2026 Closes With $1.3 Million in Zero-Day Payouts
Cybersecurity researchers successfully demonstrated 47 unique zero-day exploits at Pwn2Own Berlin 2026, targeting major enterprise software and AI platforms...
hunt-skill
/hunt — Bug Bounty Hunt Skill for Claude Code A complete bug...
Malicious code in payouts-report (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector becec2c60d20e2a05077102cbd8851073afafea45cec70202a05d3af32bb3ccc The package payouts-report was found to contain malicious code. Source: ossf-package-analysis...
MAL-2025-49391 Malicious code in payouts-report (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector becec2c60d20e2a05077102cbd8851073afafea45cec70202a05d3af32bb3ccc The package payouts-report was found to contain malicious code. Source: ossf-package-analysis...