PT-2026-27021

Summary When a user pays transaction fees using a Token-2022 token with a TransferFeeConfig extension, Kora's verify token payment credits the full raw transfer amount as the payment value. However, the on-chain SPL Token-2022 program withholds a portion of that amount as a transfer fee, so the...

📄 Alipay Open Redirect / API Attacker Payload Insertion

A single crafted URL enables a complete attack chain against Alipay mobile application users that can allow for data exfiltration. As the vendor has stated this is normal behavior with no apparent plans to address the problem, this is being published to make users aware. Alipay Mobile App -...

Keys on Doormats: Exposed API Credentials on the Web

Application programming interfaces APIs have become a central part of the modern IT environment, allowing developers to enrich the functionality of applications and interact with third parties such as cloud and payment providers. This interaction often occurs through authentication mechanisms tha...

PT-2026-24924

The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type...

GHSA-7VVP-J573-5584 Shopware: Unauthenticated data extraction possible through store-api.order endpoint

Summary An insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. Details Data Exposure Depending on the order payload configuration, attackers may retrieve: -...

Sextortion “I recorded you” emails reuse passwords found in disposable inboxes

Our malware removal support team recently flagged a new wave of sextortion emails, with the subject line: “You pervert, I recorded you!” If the message sounds familiar, that's because it's a variation of the long-running "Hello pervert" scam. The email claims the target’s device has been infected...

Microsoft Payment Orchestrator Service Access Control Error Vulnerability

Microsoft Payment Orchestrator Service is a Microsoft feature that provides cloud-native payment process automation and orchestration for the financial services industry. An Access Control Error vulnerability exists in Microsoft Payment Orchestrator Service, which stems from improper authenticati...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in facilitator payment processing on Solana. An attacker can interfere with or manipulate payment transactions by exploiting a race condition. Remediation Upgrade...

Improper Authentication

Overview @x402/svm is a x402 Payment Protocol SVM Implementation Affected versions of this package are vulnerable to Improper Authentication in facilitator payment processing on Solana. An attacker can interfere with or manipulate payment transactions by exploiting a race condition. Remediation...

CVE-2026-26125

Payment Orchestrator Service Elevation of Privilege Vulnerability...

EUVD-2026-9890

Payment Orchestrator Service Elevation of Privilege Vulnerability...

CVE-2026-26125

Payment Orchestrator Service Elevation of Privilege Vulnerability...

CVE-2026-26125

CVE-2026-26125 describes an elevation of privilege vulnerability affecting the Payment Orchestrator Service. The PT-2026-23573 entry confirms a privilege-escalation issue with Payment Orchestrator Service but does not specify affected versions. Multiple sources label this as a Microsoft product i...

CVE-2026-26125 Payment Orchestrator Service Elevation of Privilege Vulnerability

...

CVE-2026-26125

Payment Orchestrator Service Elevation of Privilege Vulnerability...

CVE-2026-26125 Payment Orchestrator Service Elevation of Privilege Vulnerability

...

Payment Orchestrator Service Elevation of Privilege Vulnerability

...

Microsoft Payment Orchestrator Service 访问控制错误漏洞

Microsoft Payment Orchestrator Service is a Microsoft feature that provides cloud-native payment process automation and orchestration for the financial services industry. An Access Control Error vulnerability exists in Microsoft Payment Orchestrator Service, which stems from improper authenticati...

PT-2026-23573

Name of the Vulnerable Software and Affected Versions Payment Orchestrator Service affected versions not specified Description A service elevation of privilege issue exists in the Payment Orchestrator Service. The vulnerability allows for privilege escalation. Recommendations At the moment, there...

KLA90914 PE vulnerability in Microsoft Payment Orchestrator Service

An elevation of privilege vulnerability was found in Microsoft Payment Orchestrator Service. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-26125 Exploitation CVE list CVE-2026-26125 critical KB list Solution Install necessary updates from the KB...