CVE-2026-101275

Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-101275 Insufficient validation of payment status in pretix-adyen

Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-101275

The pretix-adyen payment integration contains a vulnerability due to insufficient validation of payment status responses from Adyen. An attacker can exploit this by reusing a successful payment status response from a single transaction to authorize multiple different payments, potentially gaining...

EUVD-2026-120896

Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-101275: pretix pretix-adyen: Our payment integration with Adyen did not properly validate payment status responses

Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

PT-2026-141587

Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

PT-2026-137298

This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are i...

By-Poloss..-..CVE-2026-12432-PoC

CVE-2026-12432: WP Full Stripe Free = 8.4.4 Published : June 26, 2026 Last Updated : June 27, 2026 Researcher : Netwurm - VTDR e.V.i.G. Vulnerability Description The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the...

CVE-2026-94361

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of...

EUVD-2026-114590

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of...

PT-2026-134435

Name of the Vulnerable Software and Affected Versions Payable Payment Gateway for WooCommerce WordPress plugin versions prior to 1.3.1 Description The plugin fails to verify the authenticity of incoming payment notifications before updating the status of a WooCommerce order to paid or failed. Thi...

CVE-2026-94361: Unknown Payable Payment Gateway for WooCommerce: The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an…

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of...

CVE-2026-119422

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

EUVD-2026-113802

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

CVE-2026-119422

Juspay Hyperswitch before version 1.128.0 is vulnerable to an authentication bypass in the Worldpayxml connector . The root cause is that the verify_webhook_source function always returns true without enforcing mTLS , allowing unauthenticated attackers to forge payment status updates. By providin...

CVE-2026-119422 Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

CVE-2026-119422 Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

CVE-2026-119422 Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

CVE-2026-119422: juspay hyperswitch: Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers…

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

PT-2026-133475

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify webhook source always returns true without enforced mTLS. Attackers knowing the merchant id and Worldp...