CVE-2026-58200 @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

CVE-2026-58200 @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

EUVD-2026-78825

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

CVE-2026-58200 @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

CVE-2026-59965

Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user, while...

CVE-2026-59965 @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user, while...

CVE-2026-59965 @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user, while...

CVE-2026-59965

@jhb.software/payload-alt-text-plugin v0.7.0 (a Payload CMS plugin) contains an authorization bypass (CWE-863) in its POST /api/alt-text-plugin/generate and /bulk endpoints. The root cause is the omission of overrideAccess: false when calling Payload's Local API (findByID and update), causing the...

CVE-2026-59965 @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user, while...

EUVD-2026-78819

Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user, while...

MAL-2026-16195 Malicious code in tailwind-forms-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f06c2ce29f04ce06cfb494996cb6ffde7aea02af92489abcacf10cbcb7beb2 tailwind-forms-styles ships a src/index.js that is fully obfuscated with obfuscator.io rotated 303-entry string array, hex-named identifiers,...

PT-2026-92142

IBM ContextForge MCP Gateway = v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content...

MiracleLinux 8 : redis:6 (AXSA:2026-1841:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1841:01 advisory. redis: Redis: Remote Code Execution via specially crafted RESTORE payload CVE-2026-66373 redis: Redis: Arbitrary code execution via TLS pending-data...

MiracleLinux 9 : redis:7 (AXSA:2026-1844:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1844:01 advisory. redis: Redis: Remote Code Execution via specially crafted RESTORE payload CVE-2026-66373 redis: Redis: Denial of Service via Out-of-Bounds Read in...

PT-2026-92123

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

MiracleLinux 9 : redis-6.2.24-1.el9_8 (AXSA:2026-1829:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1829:03 advisory. redis: Redis: Remote Code Execution via specially crafted RESTORE payload CVE-2026-66373 redis: Redis: Arbitrary code execution via TLS pending-data...

CVE-2026-44162

fluent-plugin-s3 (versions 0.7.0 to 1.8.4) is vulnerable to a decompression bomb in its in_s3 input plugin (CWE-409). The plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompression_size_limit. An attacker with permission to upload o...

Important: Red Hat Security Advisory: redis security update

An update for redis is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2026-84179

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

EUVD-2026-77524

Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...