What’s Vulnerable › Products

ZenHive mpp vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your ZenHive mpp version is affected

Latest ZenHive mpp vulnerabilities

• CVE-2026-89420 — Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free (CVSS 7.1)
• CVE-2026-87119 — mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed (CVSS 8.2)
• CVE-2026-89186 — mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches (CVSS 6.3)
• CVE-2026-88255 — mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot (CVSS 6.3)
• CVE-2026-82751 — Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning (CVSS 8.3)
• CVE-2026-82750 — Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation (CVSS 8.3)
• CVE-2026-59695 — Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain (CVSS 8.3)
• CVE-2026-59694 — Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment (CVSS 8.3)
• CVE-2026-59252 — Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain (CVSS 8.2)