Payload: Sort queries could expose protected field information

Impact Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read. You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields. Patches Payload now applies field-level...

Insufficiently Protected Credentials

Overview @modelcontextprotocol/core is a Model Context Protocol for TypeScript — public Zod schemas spec + OAuth/OpenID Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the fetchToken and discardIfIssuerMismatch functions in the OAuth client...

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

Summary In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server...

LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values

Summary @langchain/redis did not properly escape values used to construct structured RediSearch TAG and TEXT filters. An application that passes attacker-controlled values into these filters could allow the attacker to alter the resulting search query. Affected versions @langchain/redis versions...

CVE-2026-63690

Dell Container Storage Modules, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to...

CVE-2026-63690

Dell Container Storage Modules (CSM) versions prior to 1.18.0 are vulnerable to a Missing Authentication for Critical Function vulnerability in the csi-powerflex , csi-powermax , and csi-powerstore components. An unauthenticated attacker with adjacent network access can exploit this flaw to cause...

CVE-2026-63690

Dell Container Storage Modules, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to...

EUVD-2026-93466

Dell Container Storage Modules, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to...

CVE-2026-105805 Payload: Sort queries could expose protected field information

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information...

CVE-2026-105805 Payload: Sort queries could expose protected field information

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information...

CVE-2026-105805 Payload: Sort queries could expose protected field information

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information...

EUVD-2026-93464

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information...

CVE-2026-105805

The Payload headless content management system is vulnerable to information disclosure in versions before 3.88.0 and canary versions before 4.0.0-canary.27 . An untrusted user capable of querying a readable collection and controlling its sorting parameters can select a protected field as a sort p...

CVE-2026-63689

Dell Container Storage Modules, versions prior to 1.18.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-63689

Dell Container Storage Modules (CSM) , versions prior to 1.18.0, are vulnerable to an Insertion of Sensitive Information into Log File (CWE-532). A low privileged attacker with remote access could exploit this to cause Information disclosure . While some reports describe related vulnerabilities i...

CVE-2026-63689

Dell Container Storage Modules, versions prior to 1.18.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

EUVD-2026-93462

Dell Container Storage Modules, versions prior to 1.18.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-54472

Dell Container Storage Modules, versions prior to 1.18.0, contains an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.9.8...

CVE-2026-54472

Dell Container Storage Modules, versions prior to 1.18.0, contains an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.9.8...

CVE-2026-105799

LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search...