CVE-2026-25574

Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference IDOR vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default...

CVE-2026-25574

Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference IDOR vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default...

CVE-2026-25574

Payload CMS prior to 3.74.0 is affected by a cross-collection IDOR in the payload-preferences internal collection. In multi-auth environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to ...

CVE-2026-25574 Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)

Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference IDOR vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default...

CVE-2026-25574 Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)

Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference IDOR vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default...

The vulnerability of the multiq3_attach() function in the drivers/comedi/drivers/multiq3.c module allows attackers to cause a service failure for Linux operating system-based data collection devices.

The vulnerability of the multiq3attach function in the drivers/comedi/drivers/multiq3.c module, which supports Linux kernel-based data collection devices, is related to the improper disabling or release of resources. Exploiting this vulnerability can allow a remote attacker to cause service...

CVE-2026-25574: Authorization Bypass Through User-Controlled Key

Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference IDOR vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default...

firefox: thunderbird: Use-after-free in the JavaScript: GC component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component...

PT-2026-6651

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.74.0 Description Payload is a headless content management system. A cross-collection Insecure Direct Object Reference IDOR exists in the payload-preferences internal collection. In multi-auth collection environments...

Top 10 Cloud Compliance Tools for Enterprise Security and Audit Readiness in 2026

Key Takeaways Cloud compliance has shifted from periodic audits to a continuous operating requirement as hybrid and multi-cloud environments change faster than traditional controls can keep pace. Modern cloud compliance solutions provide continuous, automated compliance monitoring across AWS,...

firefox: thunderbird: Use-after-free in the JavaScript: GC component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component...

firefox: thunderbird: Use-after-free in the JavaScript: GC component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component...

Advisory ROSA-SA-2026-3121

software: binutils 2.38 WASP: ROSA-CHROME unaffected versions = binutils-2.38-7 affected versions binutils-2.38-7 CVE-ID: CVE-2025-5244 BDU-ID: 2025-10924 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the elfgcsweep function of the ld component of the GNU Binutils software development tool is...

The vulnerability of the software for centralized logging, analysis, and storage of logs by Graylog, related to deficiencies in authentication procedures, allows attackers to escalate their privileges.

The vulnerability of the Graylog log collection, analysis, and storage software lies in the deficiencies of the authentication process. Exploiting this vulnerability allows a malicious actor to enhance their privileges remotely...

nullsec-payloads

NullSec Payloads ███▄ █ █ ██ ██▓ ██▓...

The vulnerability of the IntraService customer interaction system, related to the lack of measures taken to protect the website structure, allows attackers to inject arbitrary HTML content to replace the interface visually and collect metadata.

The vulnerability of the IntraService customer interaction system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML content into the interface, thereby replacing the visual appearance of the...

[SECURITY] Fedora 42 Update: libpcap-1.10.6-1.fc42

Libpcap provides a portable framework for low-level network monitoring. Libpcap can provide network statistics collection, security monitoring and network debugging. Since almost every system vendor provides a different interface for packet capture, the libpcap authors created this...

MiracleLinux 9 : thunderbird-102.5.0-2.el9.ML.1 (AXSA:2023-5045:06)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-5045:06 advisory. Mozilla: Service Workers might have learned size of cross-origin media files CVE-2022-45403 Mozilla: Fullscreen notification bypass CVE-2022-45404...

MiracleLinux 8 : java-1.8.0-openjdk-1.8.0.372.b07-1.el8 (AXSA:2023-5313:07)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5313:07 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK:...

MiracleLinux 8 : thunderbird-115.14.0-1.el8_10.ML.1 (AXSA:2024-8693:19)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-8693:19 advisory. Thunderbird: 115.14/128.1 mozilla: Fullscreen notification dialog can be obscured by document content CVE-2024-7518 mozilla: Out of bounds memory...