Pay

This hub aggregates every CVE we track for Pay, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 6 most recently published vulnerabilities affecting Pay.

• CVE-2026-70658pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier7.4Sep 14, 2026
• CVE-2026-33661WeChat Pay callback signature verification bypassed when Host header is localhost8.6Mar 26, 2026
• CVE-2023-30614Improper Neutralization of Script-Related HTML Tags in a Web Page in pay7.1Apr 19, 2023
• CVE-2022-35917Weakness in Transfer Validation Logic in @solana/pay5.3Aug 1, 2022
• CVE-2021-25527Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allows attacker to access Bill Pay and Recharge menu without authentication.3.8Dec 8, 2021
• CVE-2021-25525Improper check or handling of exception conditions vulnerability in Samsung Pay (US only) prior to version 4.0.65 allows attacker to use NFC without user recognition.2.0Dec 8, 2021