MAL-2026-3053 Malicious code in @apple-pay-trust/merchant-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 923c69f651ada0a2a6e4033304213ed069036ecf60291ba062fff36b1253d48f The package @apple-pay-trust/merchant-session was found to contain malicious code. Source: ghsa-malware...

Malicious code in @google-pay-trust/cancelled (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b7b08b4a3e94724e2b15686c111c5633ab73daf6f54dbcc7b758b91cfa3797a The package @google-pay-trust/cancelled was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3062 Malicious code in @google-pay-trust/cancelled (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b7b08b4a3e94724e2b15686c111c5633ab73daf6f54dbcc7b758b91cfa3797a The package @google-pay-trust/cancelled was found to contain malicious code. Source: ghsa-malware...

Malicious code in @google-pay-trust/authorize-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34948be5ad2a3e52a1e1c577dafd82b6711762743bfd51bfd6433e7a780f7e36 The package @google-pay-trust/authorize-payment was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3061 Malicious code in @google-pay-trust/authorize-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34948be5ad2a3e52a1e1c577dafd82b6711762743bfd51bfd6433e7a780f7e36 The package @google-pay-trust/authorize-payment was found to contain malicious code. Source: ghsa-malware...

Malicious code in @apple-pay-trust/start (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92fc55ea349311a75b2010e08e3c5bc6ad5498bf7f0ed78d942231a42ca46f8d The package @apple-pay-trust/start was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3054 Malicious code in @apple-pay-trust/start (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92fc55ea349311a75b2010e08e3c5bc6ad5498bf7f0ed78d942231a42ca46f8d The package @apple-pay-trust/start was found to contain malicious code. Source: ghsa-malware...

Malicious code in @google-pay-trust/init-google-pay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 155365fdfef6534b365ca7ef2fd9ec698aa3a0af9e1130483658eba525f70e81 The package @google-pay-trust/init-google-pay was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3064 Malicious code in @google-pay-trust/init-google-pay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 155365fdfef6534b365ca7ef2fd9ec698aa3a0af9e1130483658eba525f70e81 The package @google-pay-trust/init-google-pay was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3063 Malicious code in @google-pay-trust/finish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd69ccad4854f078fe0d815a4f14a1b8ef69fd62704fbf4be49710a2c3926b2 The package @google-pay-trust/finish was found to contain malicious code. Source: ghsa-malware...

Malicious code in @google-pay-trust/finish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd69ccad4854f078fe0d815a4f14a1b8ef69fd62704fbf4be49710a2c3926b2 The package @google-pay-trust/finish was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3055 Malicious code in @apple-pay-trust/validate-merchant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04e899c9f267696289778cbf0c2c4f8da289e47bb3bce95ffa4fa4e3fe290722 The package @apple-pay-trust/validate-merchant was found to contain malicious code. Source: ghsa-malware...

EUVD-2026-23225

The goodoneuz/pay-uz Laravel package = 2.2.24 contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remot...

CVE-2026-31843

The goodoneuz/pay-uz Laravel package = 2.2.24 contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remot...

CVE-2026-31843

The goodoneuz/pay-uz Laravel package = 2.2.24 contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remot...

CVE-2026-31843

The goodoneuz/pay-uz Laravel package = 2.2.24 contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remot...

EUVD-2026-23194

The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 7.0.0 due to successfulrequest handlers calculating a local signature but not validating DsSignature from the request before...

CVE-2026-5050

The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 7.0.0 due to successfulrequest handlers calculating a local signature but not validating DsSignature from the request before...

CVE-2026-5050

The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 7.0.0 due to successfulrequest handlers calculating a local signature but not validating DsSignature from the request before...

CVE-2026-5050

The CVE-2026-5050 entry details a vulnerability in the Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress. Affected versions are up to and including 7.0.0. The root cause is improper verification of cryptographic signatures: successful_request() handlers compute a local signature ...