CVE-2026-81026

The MasterStudy LMS WordPress Plugin (versions before 3.7.40 ) is vulnerable to an Unauthenticated Payment Bypass via PayPal IPN. The plugin fails to verify the amount, receiver, currency, or status of a payment notification before marking an order as completed. This allows unauthenticated users ...

EUVD-2026-68062

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...

kora-lib: Token-2022 Transfer Fee Not Deducted During Payment Verification

Summary When a user pays transaction fees using a Token-2022 token with a TransferFeeConfig extension, Kora's verifytokenpayment credits the full raw transfer amount as the payment value. However, the on-chain SPL Token-2022 program withholds a portion of that amount as a transfer fee, so the...

GHSA-725G-W329-G7QR kora-lib: Token-2022 Transfer Fee Not Deducted During Payment Verification

Summary When a user pays transaction fees using a Token-2022 token with a TransferFeeConfig extension, Kora's verifytokenpayment credits the full raw transfer amount as the payment value. However, the on-chain SPL Token-2022 program withholds a portion of that amount as a transfer fee, so the...

PT-2026-27021

Summary When a user pays transaction fees using a Token-2022 token with a TransferFeeConfig extension, Kora's verify token payment credits the full raw transfer amount as the payment value. However, the on-chain SPL Token-2022 program withholds a portion of that amount as a transfer fee, so the...

x402-native-token-payment-demo (>=0.0.0-alpha, <=0.0.1) potentially affected by unknown CVE via x402-hono (0.3.4)

x402-hono NPM version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on x402-hono and may be impacted: - x402-native-token-payment-demo =0.0.0-alpha, =0.0.1 Source cves: unknown CVE Source advisory: SNYK:JS-X402HONO-12239901...

x402-native-token-payment-demo (>=0.0.0-alpha, <=0.0.1) potentially affected by unknown CVE via x402-hono (0.3.4)

x402-hono NPM version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on x402-hono and may be impacted: - x402-native-token-payment-demo =0.0.0-alpha, =0.0.1 Source cves: unknown CVE Source advisory: OSV:GHSA-3J63-5H8P-GF7C...