5256 matches found
CVE-2026-73314
XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported authalgo header value. When the algorithm cannot be mapped to a...
CVE-2026-73316
XenForo before 2.3.13 is affected by a payment replay vulnerability in the PayPal REST payment provider . The root cause is a missing duplicate transaction ID check , which allows an attacker to replay a valid webhook payload multiple times. This triggers duplicate payment events , resulting in r...
CVE-2026-73316 XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate...
EUVD-2026-72753
XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate...
CVE-2026-73316 XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate...
EUVD-2026-72786
XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...
CVE-2026-73315 XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...
CVE-2026-73315 XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...
CVE-2026-73315
XenForo before 2.3.13 contains a Server-Side Request Forgery (SSRF) vulnerability in the PayPal REST webhook handler . Unauthenticated attackers can submit a crafted POST to the PayPal webhook callback endpoint with a certificate URL lacking scheme, hostname, or allowlist validation, causing the ...
CVE-2026-73314 XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook
XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported authalgo header value. When the algorithm cannot be mapped to a...
EUVD-2026-72785
XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported authalgo header value. When the algorithm cannot be mapped to a...
CVE-2026-73314 XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook
XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported authalgo header value. When the algorithm cannot be mapped to a...
CVE-2026-73314
XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler . When an unauthenticated attacker submits a webhook request with an unsupported auth_algo header value, the verification function incorrectly returns true instead of failing, causing the system...
PT-2026-87061
XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate...
PT-2026-88511
Impact The GitHub Trigger generated a signing secret when it registered a webhook and verified X-Hub-Signature-256 on each delivery. When GitHub answered the create request with a 422 because a webhook for the URL already existed, the node adopted the remote hook but kept only its id and events,...
PT-2026-87060
XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...
PT-2026-87059
XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth algo header value. When the algorithm cannot be mapped to a...
CVE-2026-86486
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank...
CVE-2026-86485
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks...
CVE-2026-86486
In JetBrains YouTrack versions before 2026.2.18634 , the generic VCS webhook handler had a fail-open condition when its secret was blank, meaning the handler would not properly validate incoming webhook requests if no secret had been configured. This results in a low integrity impact with a high ...