https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-73829.htmlhttps://patchthecve.com/cve/CVE-2026-73829.htmlThu, 10 Sep 2026 18:30:09 +0000LOW 3.7: Time-of-check Time-of-use (TOCTOU) Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-marhttps://patchthecve.com/cve/CVE-2026-73541.htmlhttps://patchthecve.com/cve/CVE-2026-73541.htmlThu, 10 Sep 2026 18:24:36 +0000HIGH 8.2: Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings (max_gas, mahttps://patchthecve.com/cve/CVE-2026-73136.htmlhttps://patchthecve.com/cve/CVE-2026-73136.htmlThu, 10 Sep 2026 18:17:22 +0000HIGH 7.5: Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an atthttps://patchthecve.com/cve/CVE-2026-67581.htmlhttps://patchthecve.com/cve/CVE-2026-67581.htmlThu, 10 Sep 2026 18:00:52 +0000HIGH 7.5: Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount (ERC-20) or to