Payload relationship-query authorization bypass

Impact A readable collection could expose information about protected documents in a related collection. You are affected if: - You expose a readable collection with a relationship to a collection protected by access.read where constraints. Patches Users should upgrade Payload packages to = 3.90....

Missing Authorization

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Missing Authorization via the contains query operator on relationship, upload, and join fields, where access control filters injected for a related collection a...

Missing Authorization

Overview @payloadcms/db-mongodb is a The officially supported MongoDB database adapter for Payload Affected versions of this package are vulnerable to Missing Authorization via the contains query operator on relationship, upload, and join fields, where access control filters injected for a relate...

Missing Authorization

Overview @payloadcms/drizzle is an A library of shared functions used by different payload database adapters Affected versions of this package are vulnerable to Missing Authorization via the contains query operator on relationship, upload, and join fields, where access control filters injected fo...

CVE-2026-105852 Payload relationship-query authorization bypass

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where...

CVE-2026-105852 Payload relationship-query authorization bypass

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where...

CVE-2026-105852

The Payload headless content management system (versions before 3.90.0 and canary versions before 4.0.0-canary.34 ) is vulnerable to an authorization bypass via the contains query operator on relationship, upload, and join fields. The root cause is that access control filters for related collecti...

CVE-2026-105852 Payload relationship-query authorization bypass

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where...

grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads

A flaw was found in Grafana. An unauthenticated attacker can exploit the public dashboard query endpoint by sending arbitrarily large JSON payloads. This vulnerability, caused by a lack of request body size limits, triggers excessive memory allocation, leading to a denial of service through memor...

GHSA-5X6V-P487-7QH2 LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values

Summary @langchain/redis did not properly escape values used to construct structured RediSearch TAG and TEXT filters. An application that passes attacker-controlled values into these filters could allow the attacker to alter the resulting search query. Affected versions @langchain/redis versions...

CVE-2026-105799 LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values

LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search...

CVE-2026-105799

The @langchain/redis component in LangChain (prior to version 1.1.1 ) is vulnerable to RediSearch Filter Injection due to a failure to escape attacker-controlled values in structured TAG and TEXT filters. An attacker can inject RediSearch syntax to modify or broaden search queries. If an applicat...

EUVD-2026-93431

LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search...

Malicious code in @kxa/xbails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

CVE-2026-87975

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...

UBUNTU-CVE-2026-98359

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ibgetethspeed ibdevicegetnetdev intentionally returns a referenced netdevice even when it is unregistering, so matching and cleanup callers can still find the association. The reference...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via redundant regular expression compilation in query parameter decoding

A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a Denial of Service DoS by sending requests containing a large number of query parameters to an affected endpoint. Due to redundant regular expression compilation within the parameter decoding loop, processing these...

Malicious code in @badzz88/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17341 Malicious code in @badzz88/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

CVE-2026-104040

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol OData queries. A low-privileged local user can exploit this flaw by submitting a crafted...