EUVD-2026-119531

OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied formpid or the patientidcc value in Sphere data to onsiteportalactivity without checking it against the session patient. Authenticated portal patients can submit...

PT-2026-139989

OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied form pid or the patient id cc value in Sphere data to onsite portal activity without checking it against the session patient. Authenticated portal patients can submit...

CVE-2026-124476: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the…

OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied formpid or the patientidcc value in Sphere data to onsiteportalactivity without checking it against the session patient. Authenticated portal patients can submit...

PT-2026-137298

This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are i...

CVE-2026-91075

The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without payin...

CVE-2026-103310

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without...

EUVD-2026-115103

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without...

CVE-2026-73314

CVE-2026-73314: Unsupported PayPal signature algorithm accepted XenForo before 2.3.13 fails open when a PayPal REST webhook names an unsupported signature algorithm. What happens The webhook handler maps PAYPAL-AUTH-ALGO through a small allowlist. If the value is unknown, the mapped algorithm...

CVE-2026-119422

Juspay Hyperswitch before version 1.128.0 is vulnerable to an authentication bypass in the Worldpayxml connector . The root cause is that the verify_webhook_source function always returns true without enforcing mTLS , allowing unauthenticated attackers to forge payment status updates. By providin...

CVE-2026-119422 Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

CVE-2026-119422 Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

CVE-2026-119422 Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

PT-2026-135355

Name of the Vulnerable Software and Affected Versions PayHere Payment Gateway WordPress plugin versions 2.4.0 through 2.4.5 Description This issue occurs because the plugin fails to verify the authenticity of payment notifications when the merchant secret is unset, which is the default...

MeWebStudio Turkish banks virtual POS package input validation error vulnerability

MeWebStudio has a vulnerability related to input validation in version 2.0.0 and earlier of its virtual POS package for Turkish banks. This vulnerability stems from insufficient data authenticity checks. The 3D Pay and 3D Host processors in GarantiPos, PayForPos, and InterPos bypass the check3DHa...

CVE-2026-103332

The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation secret that is empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark any ord...

CVE-2026-103306

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any...

CVE-2026-103298

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to for...

PT-2026-123174

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any...

CVE-2026-110285 WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret

The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying...

CVE-2026-110285

The WP Stripe Checkout WordPress plugin (versions before 1.2.2.62 ) contains a vulnerability where it fails to verify Stripe webhook signatures when no signing secret is configured. Since no signing secret is configured by default, unauthenticated attackers can forge a payment completion notifica...