CVE-2026-34210High· 8.1▾ Twilightmppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a v…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
0.5% → 0.6%
mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential containing the same spt token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This allowed an attacker to pay once and consume unlimited resources by replaying the credential. This issue has been patched in version 0.4.11.
mppx < 0.4.11Upgrade past the affected range:
mppx 0.4.11Connected by shared product, vendor, weakness, or advisory.
CVE-2026-34209High· 7.5mppx is a TypeScript interface for machine payments protocol
CVE-2026-63627Medium· 6.9mppx is a TypeScript interface for machine payments protocol
CVE-2026-63628Medium· 6.9mppx is a TypeScript interface for machine payments protocol
CVE-2026-104198Medium· 5.3ZoneMinder is a free, open source closed-circuit television software application
CVE-2026-108969High· 7.3A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449
CVE-2021-34141Medium· 5.3An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects