CVE-2026-45806

CVE-2026-45806 Penpot's remote image import let an authenticated file editor turn a normal media convenience feature into backend-origin SSRF because attacker-controlled URLs crossed into a redirect-following server fetch path without destination filtering. Intro I found this issue while reviewin...

Payload: SQL Injection in SQLite and Postgres

Impact A user can submit a request that exploits a SQL Injection vulnerability in Payload. You are affected if: - You use an affected Payload version. - Untrusted users can query readable collections using dynamic filters or joins. You are not affected if you use MongoDB @payloadcms/mongodb...

SQL Injection

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to SQL Injection through the read query path in find, findDistinct, findVersions, update, and join query handling in the Payload collection and global operations. ...

GHSA-V49J-62M6-PGRR Payload: SQL Injection in SQLite and Postgres

Impact A user can submit a request that exploits a SQL Injection vulnerability in Payload. You are affected if: - You use an affected Payload version. - Untrusted users can query readable collections using dynamic filters or joins. You are not affected if you use MongoDB @payloadcms/mongodb...

GHSA-FPWW-C55P-CJV6 Payload: Polymorphic join queries could disclose hidden fields

Impact A user with query access could use polymorphic join filters to infer hidden or read-restricted field values, including password-reset tokens. You are affected if: - You use an affected Payload version. - Users can query a collection with a polymorphic join to sensitive fields. Patches User...

Payload: Polymorphic join queries could disclose hidden fields

Impact A user with query access could use polymorphic join filters to infer hidden or read-restricted field values, including password-reset tokens. You are affected if: - You use an affected Payload version. - Users can query a collection with a polymorphic join to sensitive fields. Patches User...

NPM: Payload: Polymorphic join queries could disclose hidden fields

NPM: Payload: Polymorphic join queries could disclose hidden fields vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

Authorization Bypass Through User-Controlled Key

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via polymorphic join query validation in validateSearchParams.ts, where hidden or read-restricted fields are no...

grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads

A flaw was found in Grafana. An unauthenticated attacker can exploit the public dashboard query endpoint by sending arbitrarily large JSON payloads. This vulnerability, caused by a lack of request body size limits, triggers excessive memory allocation, leading to a denial of service through memor...

CVE-2022-1388

F5-CVE-2022-1388-Exploit Exploit and Check Script for CVE 2022-1388 Usage bash / | | | || | / | |/ / \ / | | || || | | / /| | | || | ' / /'| |/' |' / /'' / /'| | / / \ V / \ V / | | | | | || ||| / / | /| | / / / / ||| | \ \ / \ / \ | /\ / /| | ./ /\ |/ /./ /./ / | |./ /| || || || | / / /...

gitea-gogs-symlink-git-config-rce

Gitea / Gogs - Symlink .git/config Poisoning - RCE Descrip...

CVE-2026-27886

CVE-2026-27886 Strapi PoC For authorized security testing only. Strapi leaking sensitive data via relational filtering due to lack of query sanitization. Includes: CVE-2026-27886.py - Python PoC CVE-2026-27886.yaml - Nuclei template for detection What it checks The checker sends two requests to a...

CVE-2026-105847 Payload: Polymorphic join queries could disclose hidden fields

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset...

CVE-2026-105847

The Payload headless content management system is vulnerable to an information disclosure flaw in versions 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34 . An attacker with query access can use polymorphic join filters to infer hidden or read-restricted values from sensitive field...

CVE-2026-105847 Payload: Polymorphic join queries could disclose hidden fields

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset...

EUVD-2026-93489

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset...

CVE-2026-105847

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset...

CVE-2026-105847 Payload: Polymorphic join queries could disclose hidden fields

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset...

CVE-2026-27886-PoC-Account-Takeover

CVE-2026-27886 Automated Exploit - Usage Guide What This Script Does Automates the full account takeover chain in 4 HTTP request groups: 1. Vulnerability Verification - Confirms the target is vulnerable 2. Email Enumeration - Extracts admin email via boolean oracle 500 requests 3. Password Reset...

cve-2026-9082

CVE-2026-9082 Type : SQL Injection CWE-89 Affected Product : Drupal Core Database Abstraction API Drupal Advisory : SA-CORE-2026-004 Published : May 20, 2026 Severity : Highly Critical Drupal 20/25 | NVD CVSS 6.5 What Is It? CVE-2026-9082 is a SQL Injection vulnerability in Drupal's core database...