{"metadata": {"vulnerability": "cve-2026-107852", "count": 10, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-08T22:34:49.292Z", "date_only": false, "value": "2026-10-08T22:34:49.292Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-107852", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-09T20:28:06.513Z", "date_only": false, "value": "2026-10-09T20:28:06.513Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-107852", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-09T20:28:06.513Z", "date_only": false, "value": "2026-10-09T20:28:06.513Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2026-107852", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-09T20:39:00.270Z", "date_only": false, "value": "2026-10-09T20:39:00.270037Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117412878022445121", "record": "CVE-2026-107852", "field": "creation_timestamp", "uuid": "1ac51e17-c66e-4f05-b364-85375992522f", "content": "CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery) Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when payment_status is paid but does not compare amount_total or currency with the referenced order and configured billing currency. On an instance where the billing module is enabled and a Stripe secret key is configured, an authenticated client can therefore complete a lower-value or mismatched-currency payment and cause the order to be processed, provisioning, renewing, upgrading, or unsuspending the purchased server for less than the required price. This issue is fixed in version 4.0.5.\nhttps://www.cve.org/CVERecord?id=CVE-2026-107852https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-rf56-676w-hj4ghttps://github.com/Jexactyl/Jexactyl/commit/fdee722c560ac13dc2d26271912203a6085dffe3https://github.com/Jexactyl/Jexactyl/releases/tag/v4.0.5#Jexactyl#CVE_2026_107852#bot", "url": "https://infosec.exchange/users/cve/statuses/117412878022445121"}, {"timestamp": "2026-10-09T21:17:03.080Z", "date_only": false, "value": "2026-10-09T21:17:03.080", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107852", "record": "FKIE_CVE-2026-107852", "field": "published"}, {"timestamp": "2026-10-14T02:11:02.263Z", "date_only": false, "value": "2026-10-14T02:11:02.263904Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-107852", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T02:11:02.263Z", "date_only": false, "value": "2026-10-14T02:11:02.263904Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107852", "record": "FKIE_CVE-2026-107852", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T02:11:26.450Z", "date_only": false, "value": "2026-10-14T02:11:26.450Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-107852", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T02:11:26.450Z", "date_only": false, "value": "2026-10-14T02:11:26.450Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-107852", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T20:04:29.760Z", "date_only": false, "value": "2026-10-16T20:04:29.760", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107852", "record": "FKIE_CVE-2026-107852", "field": "lastModified"}]}