CVE-2026-106433

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...

CVE-2026-106433 Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...

CVE-2026-106433

Improper state management in MongoDB libmongocrypt allows for heap corruption when cleaning up a key document that contains duplicate masterKey fields. This flaw causes provider-specific data to be treated as an incompatible type, leading to invalid memory access and invalid frees in the client p...

CVE-2026-106433 Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...

CVE-2026-95106 Gitea review and execution mismatch through duplicate tree entries

Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while git checkout, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff...

CVE-2026-95106

Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while "git checkout", Gitea Actions, and release archives use the last. A contributor could open a pull request whose di...

EUVD-2026-93913

Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while git checkout, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff...

CVE-2026-95106

Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while git checkout, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff...

CVE-2026-95106 Gitea review and execution mismatch through duplicate tree entries

Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while git checkout, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff...

CVE-2026-95106 Gitea review and execution mismatch through duplicate tree entries

Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while git checkout, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff...

CVE-2026-95106

The Gitea platform is vulnerable to a review and execution mismatch because it accepts pushed Git trees containing duplicate entries with the same name, despite Git's standard consistency checks rejecting such trees. This discrepancy creates a security risk where Gitea's web views resolve a path ...

CVE-2026-105851

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that val...

Payload Ecommerce has an order confirmation validation issue

Impact When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions. You are affected if: - You use @payloadcms/plugin-ecommerce with the Stripe payment adapter. Deployments that do not use the Stripe payment flow are not affected. Patche...

Payload: Field access control bypass on auth collections

Impact Payload's duplicate operation copies field values from the source document even when a field is hidden, or its access.read or access.create rule would reject the value for that caller. The disableDuplicate collection setting, enabled by default on auth collections, did not stop this. Patch...

Incorrect Authorization

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Incorrect Authorization via the collection duplication endpoint /:id/duplicate, where the disableDuplicate collection setting was not enforced at the operation...

EUVD-2026-93494

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that val...

CVE-2026-105851 Payload: Field access control bypass on auth collections

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that val...

CVE-2026-105851 Payload: Field access control bypass on auth collections

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that val...

CVE-2026-105851

The Payload headless content management system (versions 3.0.0 to 3.89.9 and canary versions before 4.0.0-canary.34 ) contains an access-control bypass during duplicate operations. The system incorrectly copies values from a source document even if a field is hidden or if the access.read or acces...

EUVD-2026-93493

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions...