CWE-345 vulnerabilities

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel or fail them.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This vulnerability is considered critical as an unauthenticated attacker can repeatedly reuse a captured request to generate ADMIN access and refresh tokens. Since there is no nonce validation or time limit on requests, the attack can be performed indefinitely. Dell recommends customers to upgrade at the earliest opportunity

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment.

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature.

Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution.

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.

CVE-2026-19410 is a critical time-of-check time-of-use (TOCTOU) race condition vulnerability in Google Cloud Build's GitHub Trigger Comment Control. It allows a remote attacker to execute unreviewed code in the build environment by exploiting webhook suppression. This vulnerability was patched by Google on June 24, 2026, and no customer action is required.

mediasoup versions 3.20.0 through 3.20.6 (npm) and 0.22.0 through 0.22.5 (Rust crate) contain an insufficient verification of data authenticity vulnerability in their SCTP stack. The built-in SCTP stack uses hardcoded magic values instead of a per-instance secret and HMAC to authenticate state cookies, allowing an on-path attacker targeting PlainTransport or PipeTransport with SCTP enabled and no DTLS protection to forge a valid COOKIE-ECHO packet. This enables unauthorized SCTP association establishment and DataChannel message injection as a trusted peer. WebRtcTransport is not affected as its SCTP runs inside DTLS. The issue is fixed in npm version 3.20.6 and Rust crate version 0.22.5.

An improper authentication vulnerability exists in Apache Hive versions 4.0.0 through 4.2.0 when using HiveServer2 with SAML authentication over HTTP transport. This flaw allows an unauthenticated attacker with network access to the HiveServer2 HTTP port to impersonate any Hive user by sending a forged Authorization: Bearer token to the /cliservice endpoint. No Hive credentials, SAML IdP login, or server signing secret knowledge is required. The vulnerability does not affect deployments where Apache Knox handles SSO and HiveServer2 uses LDAP or Kerberos authentication.

A vulnerability in the authlib joserfc Python library prior to version 1.7.3 allows issuer-validation bypass due to improper handling of array-valued 'iss' claims in JWT token validation. This can lead to authentication bypass by spoofing the issuer claim. The issue is fixed in version 1.7.3.

CVE-2026-78417 is a medium severity vulnerability in Devolutions Remote Desktop Manager affecting versions prior to 2026.2.18 and 2026.1.25. It involves insufficient verification of data authenticity in the IronVNC client, allowing an on-path attacker to intercept and tamper with VNC sessions by exploiting automatic acceptance of the server's RSA key during RSA-AES authentication.

CVE-2026-48106 is a high-severity vulnerability in Basekick-Labs' Arc, an open SQL-native time-series database. Versions prior to 26.06.1 have a missing authentication mechanism for the MsgReplicateSync payload in the cluster replication receiver, allowing application-layer message tampering or replay attacks despite transport-layer TLS/mTLS protection. The issue is fixed in version 26.06.1. Workarounds include restricting cluster network access, auditing replication logs, or disabling cluster mode until patched.

CVE-2026-48105 is a path traversal vulnerability in Basekick-Labs' Arc Enterprise time-series database prior to version 26.06.1. The Raft FSM component accepts attacker-controlled file paths without proper validation, allowing potentially unauthorized file access or manipulation. The vulnerability is fixed in version 26.06.1. Mitigations include restricting cluster network access to trusted peers, auditing manifest paths, or disabling cluster mode until patched.

The Charitable WordPress plugin versions before 1.8.12 do not verify the authenticity of incoming Square payment webhook events by default. This vulnerability allows unauthenticated attackers to forge webhook notifications, causing the plugin to mark donations as paid without actual payment. The issue is classified as CWE-345, insufficient verification of data authenticity. The CVSS score is 5.3, indicating a medium severity level.

The myCred WordPress plugin versions before 3.2.5 contain a vulnerability where the plugin does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account. This flaw allows unauthenticated attackers to credit arbitrary amounts of the site's in-site currency to an account by completing a payment to a gateway account they control instead of the legitimate merchant account.