CVE-2026-15781: Stack-based Buffer Overflow

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...

CVE-2026-89322

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy,...

Security Bulletin: Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution

Summary Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...

CVE-2026-89322

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy,...

CVE-2026-89322 Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy,...

CVE-2026-76280 Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "scadmin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in...

CVE-2026-76280

Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72 are vulnerable to an incorrect permission assignment in App Key Value Store (KV Store) collections. An authenticated user without "admin" or "sc_admin" roles ...

GHSA-P96C-XWX8-3CQJ Payload has a tenant authorization bypass in Multi-Tenant Plugin

Impact When using the default tenant array field access, an authenticated user could assign themselves to other tenants. You are affected if: - You are using @payloadcms/plugin-multi-tenant If you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership...

EUVD-2026-93506

Payload has a tenant authorization bypass in Multi-Tenant Plugin...

EUVD-2026-93507

Payload external upload trust validation issue...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-uploadthing is a Payload storage adapter for uploadthing Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker ca...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated...

Cross-site Scripting (XSS)

Overview @payloadcms/payload-cloud is a The official Payload Cloud plugin Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker can upload a...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-gcs is a Payload storage adapter for Google Cloud Storage Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker c...

@payloadcms/plugin-multi-tenant has a cross-tenant create issue

Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: - You are using...

GHSA-XHM9-GWGW-3Q2Q @payloadcms/plugin-multi-tenant has a cross-tenant create issue

Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: - You are using...

EUVD-2026-93510

@payloadcms/plugin-multi-tenant has a cross-tenant create issue...

EUVD-2026-93511

Payload: Incomplete validation during the upload file lifecycle...

EUVD-2026-93513

Payload: Client uploads could overwrite S3 objects...

Arbitrary File Upload

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData an...