CVE-2026-77470 Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request

Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additionaldata array and CheckoutService::preparePurchaseParameters merges it after server-computed purchase parameters. Because later...

CVE-2026-108174

The PluginUs.Net FOX woocommerce-currency-switcher WordPress plugin, versions up to and including 1.5.4 , is vulnerable to a Missing Authorization (CWE-862) issue. The vulnerability stems from Incorrectly Configured Access Control Security Levels , potentially allowing unauthorized actions. The i...

CVE-2026-108174: Missing Authorization

Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4...

CVE-2026-107852

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

CVE-2026-107852: Insufficient Verification of Data Authenticity

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

PT-2026-109309

Name of the Vulnerable Software and Affected Versions Jexactyl versions prior to 4.0.5 Description The POST '/api/client/billing/stripe/process' endpoint accepts a client-supplied Stripe Checkout Session when payment status is paid without verifying if the amount total or currency matches the...

CVE-2026-97071

Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17...

CVE-2026-97071 WordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability

Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17...

EUVD-2026-92310

Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17...

CVE-2026-97071: Incorrect Calculation

Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17...

PT-2026-104785

Name of the Vulnerable Software and Affected Versions VillaTheme CURCY woo-multi-currency versions prior to 2.2.18 Description An incorrect calculation issue allows integer attacks, which occur when an application fails to properly handle integer overflows or underflows, potentially leading to...

CVE-2026-105097

A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

PT-2026-96660

Name of the Vulnerable Software and Affected Versions Hostel plugin for WordPress versions prior to 1.1.9 Description Insufficient input sanitization and output escaping allow authenticated attackers with Administrator-level access to perform Stored Cross-Site Scripting. This issue occurs via the...

CVE-2026-54608: Insufficient Verification of Data Authenticity

MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...

SUSE CVE-2026-54754

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a...

CVE-2026-54754

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a...

CVE-2026-54754 Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a...

CVE-2026-54754

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a...

CVE-2026-54754 Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a...