19485 matches found
CVE-2026-105848
Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...
Access Control Bypass
Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Access Control Bypass via the updateDocument function in packages/payload/src/collections/operations/utilities/update.ts, where the password field is extracted...
Missing Authorization
Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Missing Authorization via document read operations that return the apiKey field without omitting it, allowing an authenticated user with read access to other us...
CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy
Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...
EUVD-2026-93490
Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...
CVE-2026-105848
Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...
CVE-2026-105848
The @payloadcms/plugin-stripe component in the Payload CMS headless content management system is vulnerable to insufficient access control in its optional Stripe REST proxy. An authenticated user capable of reaching the enabled proxy can perform unintended Stripe operations . This issue affects v...
CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy
Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...
CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy
Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...
CVE-2026-75818
A flaw was found in GNU Aspell's prezip-bin utility. The decompression component does not properly validate buffer space when decompressing input files. An attacker could convince a user to process a specially crafted compressed file, triggering out-of-bounds memory operations that cause memory...
wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...
wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...
AZL-106329 CVE-2026-98248 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpunamecasesz and percpunamereturncasesz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a...
DEBIAN-CVE-2026-98248
In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpunamecasesz and percpunamereturncasesz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a...
UBUNTU-CVE-2026-98248
In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpunamecasesz and percpunamereturncasesz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a...
CVE-2026-98248
In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpunamecasesz and percpunamereturncasesz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a...
CVE-2026-98248 arm64: percpu: Fix LSE operations on {8,16}-bit types
In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpunamecasesz and percpunamereturncasesz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a...
CVE-2026-98248
The Linux kernel contains a vulnerability in the arm64 architecture regarding percpu operations. Specifically, the assembly for __percpu_##name##_case_##sz() and __percpu_##name##_return_case_##sz() fails to use the 'sfx' macro argument when forming LSE instructions . This omission causes {8,16}-...
CVE-2026-98248
In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpunamecasesz and percpunamereturncasesz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a...
CVE-2026-98248 arm64: percpu: Fix LSE operations on {8,16}-bit types
In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpunamecasesz and percpunamereturncasesz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a...