Monthly
Duplicate order processing in @payloadcms/plugin-ecommerce allows remote, unauthenticated attackers to have a single Stripe order confirmation processed more than once, producing duplicate orders and repeated cart, inventory, and transaction side effects in affected Payload CMS deployments. The flaw affects @payloadcms/plugin-ecommerce versions before 3.90.0 and 4.x canary builds before 4.0.0-canary.34, and only installations that configure the Stripe payment adapter are exposed - deployments that do not use the Stripe payment flow are explicitly unaffected. No public exploit code has been identified at time of analysis, and the vendor has shipped patched releases plus guidance requiring order finalization to be idempotent.
Double close of a circuit while a Tor client is under circuit queue memory pressure can crash the process in versions before 0.4.9.7, an availability-only denial of service tracked by the Tor project as TROVE-2026-009 (CWE-837). The crash occurs only when the memory-pressure condition already exists, and the available sources do not describe how an attacker would reliably induce that state, so impact is a client crash with no code execution, data disclosure, or integrity loss. No public exploit code was identified at time of analysis, SSVC records exploitation as none and automatable as no, and EPSS is 0.04% (12th percentile).
Authenticated customers on Thelia e-commerce stores can bypass coupon usage limits by exploiting order-payment timing, allowing them to obtain discounts beyond a coupon's configured cap. The flaw affects Thelia before 3.1.5 and 3.2.x before 3.2.4, requires a valid customer account plus a usage-limited coupon and a pay-later or cancellation workflow, and carries a moderate CVSS 4.0 score of 5.3 with integrity-only impact; no public exploit identified at time of analysis.
Resource pack handler in PocketMine-MP before 5.44.2 allows connected clients to repeatedly trigger pre-spawn progression by sending multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status, causing the server to instantiate duplicate Player objects and amplify both memory consumption and network traffic. The affected code path in ResourcePacksPacketHandler.php lacked a re-entry guard to prevent handler transitions from executing more than once per session. A publicly available exploit exists via the GHSA-pg53-p7qp-65cv GitHub security advisory, though real-world impact is constrained by a CVSS 4.0 score of 2.3 and the requirement for authenticated client connections.
CAPTCHA replay exploitation in MyBB prior to 1.8.40 allows unauthenticated remote attackers to bypass anti-automation controls by reusing a previously validated CAPTCHA challenge token across five distinct action endpoints. The root cause is missing calls to captcha::invalidate_captcha() after successful validation in contact.php, member.php (do_resendactivation, do_lostpw, do_emailuser), and sendthread.php (do_sendtofriend) when the built-in captchaimage setting is active. No public exploit has been identified at time of analysis, and the flaw enables form-abuse automation rather than code execution or data exfiltration.
Item duplication in InventoryGui before version 1.6.5 affects any Bukkit/Spigot plugin whose GUI uses the library's GuiStorageElement and allows players to take items out of that element while the server's experimental Bundle item feature is enabled. An authenticated in-game player interacting with such a GUI can duplicate items, an integrity-only impact confined to in-game economy; there is no confidentiality or availability effect. No public exploit code was identified at time of analysis, EPSS is very low (0.22%, 12th percentile), and the vendor has released a patch in version 1.6.5 that primarily disables GuiStorageElement on servers older than Minecraft 1.21.9.
Item duplication in InventoryGui 1.6.1-SNAPSHOT and earlier allows authenticated players to duplicate items within chest GUIs on Bukkit/Spigot servers, but only when a plugin uses the library's GuiStorageElement and the experimental Bundle item feature is enabled on the server. The flaw resides in how collect-to-cursor actions on storage elements are processed, and it was fixed in version 1.6.2-SNAPSHOT via a commit that adds player context to storage updates. Exploitation requires an authenticated player interacting with the GUI (CVSS 4.3, PR:L), EPSS is low at 0.25%, and no public exploit has been identified at time of analysis; impact is confined to in-game item/economy integrity, not server compromise, data disclosure, or denial of service.
Item duplication in InventoryGui (a Bukkit/Spigot library for building chest-based GUIs) affects all versions up to and including 1.6.3-SNAPSHOT when a plugin uses the GuiStorageElement on a server that has the experimental Minecraft "Bundle" item feature enabled. An authenticated in-game player (CVSS vector PR:L, UI:R) who right-clicks a bundle item in such a GUI can cause items to be duplicated, resulting in a limited integrity impact; confidentiality and availability are not affected. The issue is confirmed only when both preconditions hold - the bundle experiment is turned on and the GUI is built with GuiStorageElement - so the practical risk is genuine but modest, and no public exploit code or active exploitation (no CISA KEV listing) has been identified at time of analysis; EPSS is a low 0.26% (16th percentile). A vendor fix exists in 1.6.4-SNAPSHOT (commit 00e684bd backported to 1.6.3-SNAPSHOT).
CVE-2025-54315 is a security vulnerability (CVSS 7.1). High severity vulnerability requiring prompt remediation.
Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network access. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Duplicate order processing in @payloadcms/plugin-ecommerce allows remote, unauthenticated attackers to have a single Stripe order confirmation processed more than once, producing duplicate orders and repeated cart, inventory, and transaction side effects in affected Payload CMS deployments. The flaw affects @payloadcms/plugin-ecommerce versions before 3.90.0 and 4.x canary builds before 4.0.0-canary.34, and only installations that configure the Stripe payment adapter are exposed - deployments that do not use the Stripe payment flow are explicitly unaffected. No public exploit code has been identified at time of analysis, and the vendor has shipped patched releases plus guidance requiring order finalization to be idempotent.
Double close of a circuit while a Tor client is under circuit queue memory pressure can crash the process in versions before 0.4.9.7, an availability-only denial of service tracked by the Tor project as TROVE-2026-009 (CWE-837). The crash occurs only when the memory-pressure condition already exists, and the available sources do not describe how an attacker would reliably induce that state, so impact is a client crash with no code execution, data disclosure, or integrity loss. No public exploit code was identified at time of analysis, SSVC records exploitation as none and automatable as no, and EPSS is 0.04% (12th percentile).
Authenticated customers on Thelia e-commerce stores can bypass coupon usage limits by exploiting order-payment timing, allowing them to obtain discounts beyond a coupon's configured cap. The flaw affects Thelia before 3.1.5 and 3.2.x before 3.2.4, requires a valid customer account plus a usage-limited coupon and a pay-later or cancellation workflow, and carries a moderate CVSS 4.0 score of 5.3 with integrity-only impact; no public exploit identified at time of analysis.
Resource pack handler in PocketMine-MP before 5.44.2 allows connected clients to repeatedly trigger pre-spawn progression by sending multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status, causing the server to instantiate duplicate Player objects and amplify both memory consumption and network traffic. The affected code path in ResourcePacksPacketHandler.php lacked a re-entry guard to prevent handler transitions from executing more than once per session. A publicly available exploit exists via the GHSA-pg53-p7qp-65cv GitHub security advisory, though real-world impact is constrained by a CVSS 4.0 score of 2.3 and the requirement for authenticated client connections.
CAPTCHA replay exploitation in MyBB prior to 1.8.40 allows unauthenticated remote attackers to bypass anti-automation controls by reusing a previously validated CAPTCHA challenge token across five distinct action endpoints. The root cause is missing calls to captcha::invalidate_captcha() after successful validation in contact.php, member.php (do_resendactivation, do_lostpw, do_emailuser), and sendthread.php (do_sendtofriend) when the built-in captchaimage setting is active. No public exploit has been identified at time of analysis, and the flaw enables form-abuse automation rather than code execution or data exfiltration.
Item duplication in InventoryGui before version 1.6.5 affects any Bukkit/Spigot plugin whose GUI uses the library's GuiStorageElement and allows players to take items out of that element while the server's experimental Bundle item feature is enabled. An authenticated in-game player interacting with such a GUI can duplicate items, an integrity-only impact confined to in-game economy; there is no confidentiality or availability effect. No public exploit code was identified at time of analysis, EPSS is very low (0.22%, 12th percentile), and the vendor has released a patch in version 1.6.5 that primarily disables GuiStorageElement on servers older than Minecraft 1.21.9.
Item duplication in InventoryGui 1.6.1-SNAPSHOT and earlier allows authenticated players to duplicate items within chest GUIs on Bukkit/Spigot servers, but only when a plugin uses the library's GuiStorageElement and the experimental Bundle item feature is enabled on the server. The flaw resides in how collect-to-cursor actions on storage elements are processed, and it was fixed in version 1.6.2-SNAPSHOT via a commit that adds player context to storage updates. Exploitation requires an authenticated player interacting with the GUI (CVSS 4.3, PR:L), EPSS is low at 0.25%, and no public exploit has been identified at time of analysis; impact is confined to in-game item/economy integrity, not server compromise, data disclosure, or denial of service.
Item duplication in InventoryGui (a Bukkit/Spigot library for building chest-based GUIs) affects all versions up to and including 1.6.3-SNAPSHOT when a plugin uses the GuiStorageElement on a server that has the experimental Minecraft "Bundle" item feature enabled. An authenticated in-game player (CVSS vector PR:L, UI:R) who right-clicks a bundle item in such a GUI can cause items to be duplicated, resulting in a limited integrity impact; confidentiality and availability are not affected. The issue is confirmed only when both preconditions hold - the bundle experiment is turned on and the GUI is built with GuiStorageElement - so the practical risk is genuine but modest, and no public exploit code or active exploitation (no CISA KEV listing) has been identified at time of analysis; EPSS is a low 0.26% (16th percentile). A vendor fix exists in 1.6.4-SNAPSHOT (commit 00e684bd backported to 1.6.3-SNAPSHOT).
CVE-2025-54315 is a security vulnerability (CVSS 7.1). High severity vulnerability requiring prompt remediation.
Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network access. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.