What’s Vulnerable › Products

pay-rails pay vulnerabilities

2 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.

Check whether your pay-rails pay version is affected

Latest pay-rails pay vulnerabilities

• CVE-2026-70658 — pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier (CVSS 7.4)
• CVE-2023-30614 — Improper Neutralization of Script-Related HTML Tags in a Web Page in pay (CVSS 6.1)