CVE-2026-70658

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

CVE-2026-70658

Pay is a payments engine for Ruby on Rails 6.0+. Prior to version 11.6.2 , the method Pay::Webhooks::PaddleBillingController#valid_signature? compares the computed 64-character SHA-256 HMAC against the attacker-controlled h1 token from the Paddle-Signature header using Ruby's String#== (a non-con...

CVE-2026-70658 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

EUVD-2026-77680

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

CVE-2026-70658 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

CVE-2026-70658 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

PT-2026-91283

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalid signature? in app/controllers/pay/webhooks/paddle billing controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

CVE-2026-58411

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

EUVD-2026-43557

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

CVE-2026-58411 ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

CVE-2026-58411

ChurchCRM (open-source church management system) Vulnerability: Prior to version 7.4.0, a Reflected XSS was identified due to insufficient output encoding of user-controlled request parameter names and values. The application reflects attacker-controlled input into JavaScript string contexts and ...

CVE-2026-58411 ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

deeplabcut (>=2.0.0.dev2, <=2.1.8), deeplabcutcore (>=0.0.0b1, <=0.0.0b3) +8 more potentially affected by CVE-2019-19624 via opencv-python (3.4.17.61)

opencv-python PYPI version 3.4.17.61 is affected by a known vulnerability. The following packages have a transitive dependency on opencv-python and may be impacted: - deeplabcut =2.0.0.dev2, =0.0.0b1, =2.1.1, =0.8.3, =0.3.0, =0.3.0, =3.0.5, =0.1.0a2, =0.1.0a7 Source cves: CVE-2019-19624 Source...

deeplabcut (>=2.0.0.dev2, <=2.1.8), deeplabcutcore (>=0.0.0b1, <=0.0.0b3) +8 more potentially affected by CVE-2019-14493 via opencv-python (3.4.17.61)

opencv-python PYPI version 3.4.17.61 is affected by a known vulnerability. The following packages have a transitive dependency on opencv-python and may be impacted: - deeplabcut =2.0.0.dev2, =0.0.0b1, =2.1.1, =0.8.3, =0.3.0, =0.3.0, =3.0.5, =0.1.0a2, =0.1.0a7 Source cves: CVE-2019-14493 Source...

paddle-ner (0.1.0), paddle-quantum (>=1.1.1, <=2.2.1) +3 more potentially affected by CVE-2024-1603 via paddlepaddle (1.8.5)

paddlepaddle PYPI version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on paddlepaddle and may be impacted: - paddle-ner 0.1.0 - paddle-quantum =1.1.1, =1.8.5.0, =1.8.5.1 - paddle-tokenizer 0.1.0 - pyunit-ner 2021.8.2 Source cves: CVE-2024-1603...

PaddlePaddle command injection in paddle.utils.download._wget_download

Command injection in paddle.utils.download.wgetdownload bypass filter in paddlepaddle/paddle 2.6.0...

paddle-ner (0.1.0), paddle-quantum (>=1.1.1, <=2.2.1) +3 more potentially affected by CVE-2024-0817 via paddlepaddle (1.8.5)

paddlepaddle PYPI version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on paddlepaddle and may be impacted: - paddle-ner 0.1.0 - paddle-quantum =1.1.1, =1.8.5.0, =1.8.5.1 - paddle-tokenizer 0.1.0 - pyunit-ner 2021.8.2 Source cves: CVE-2024-0817...

GHSA-MJGF-XJ26-9QF9 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Summary Pay::Webhooks::PaddleBillingControllervalidsignature? app/controllers/pay/webhooks/paddlebillingcontroller.rb verifies the Paddle Billing webhook signature by computing OpenSSL::HMAC.hexdigest... and comparing it to the attacker-supplied header value using Ruby's String==. Ruby's == is...

pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Summary Pay::Webhooks::PaddleBillingControllervalidsignature? app/controllers/pay/webhooks/paddlebillingcontroller.rb verifies the Paddle Billing webhook signature by computing OpenSSL::HMAC.hexdigest... and comparing it to the attacker-supplied header value using Ruby's String==. Ruby's == is...

Timing Attack

Overview pay is a package for processing payments in Ruby on Rails apps Affected versions of this package are vulnerable to Timing Attack via the validsignature? function. An attacker can recover valid webhook signatures by sending multiple requests with crafted Paddle-Signature header values and...