743 matches found
CVE-2026-101267
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...
EUVD-2026-88748
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...
CVE-2026-101267 Revenue information leak
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...
CVE-2026-101267
A missing permission check allows low-privileged users who have access to an event, but lack access to its orders, to extract specific information. This vulnerability leads to a revenue information leak , exposing details such as the total revenue and the number of attendees . No specific softwar...
CVE-2026-101267 Revenue information leak
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...
CVE-2026-101267 Revenue information leak
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...
PT-2026-102515
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...
EEF-CVE-2026-89420 Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free
Summary Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.acceptvoucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's...
CVE-2026-93984
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...
EUVD-2026-83589
OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypas...
CVE-2026-93984 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...
CVE-2026-93984 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...
CVE-2026-93984
OpenPanel tracking API, through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 , fails to verify the client secret cryptographic hash before authorizing revenue events and bot filtering. An attacker possessing only a public client ID can supply arbitrary dummy secrets to inject forged revenue me...
CVE-2026-93984 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...
CVE-2026-93984: Improper Authentication
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...
PT-2026-95821
Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to commit bad75bddc74d12d36cfb843f4531d3b830a8d994 Description The tracking API fails to verify the cryptographic hash of the client secret before authorizing bot filtering and revenue events. An attacker possessing on...
CVE-2026-82189 Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-service against the order pipeline: mass-failing pending orders to disrupt revenue and force manual reprocessing, or flipping already-fulfille...
CVE-2026-82189 Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-service against the order pipeline: mass-failing pending orders to disrupt revenue and force manual reprocessing, or flipping already-fulfille...
PT-2026-92396
Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-service against the order pipeline: mass-failing pending orders to disrupt revenue and force manual reprocessing, or flipping already-fulfille...
PDoS: A Profitable Denial-Of-Service Attack against Proof-Of-Work Blockchain Liveness
The security and liveness of Proof-of-Work PoW blockchains fundamentally depend on the economic rationality of miners. Existing incentive-driven denial-of-service attacks, such as BDoS, can deter rational miners from participating, but require the attacker to continuously absorb substantial...