CVE-2026-105848

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

Payload: Insufficient Access Control in Stripe REST Proxy

Impact An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy. You are affected if ALL of these are true: - Your application uses @payloadcms/plugin-stripe. - The optional Stripe REST proxy is enabled. - An authenticated user can reach the proxy...

GHSA-R9V2-GG2J-22Q5 Payload: Insufficient Access Control in Stripe REST Proxy

Impact An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy. You are affected if ALL of these are true: - Your application uses @payloadcms/plugin-stripe. - The optional Stripe REST proxy is enabled. - An authenticated user can reach the proxy...

CVE-2026-105848

The @payloadcms/plugin-stripe component in the Payload CMS headless content management system is vulnerable to insufficient access control in its optional Stripe REST proxy. An authenticated user capable of reaching the enabled proxy can perform unintended Stripe operations . This issue affects v...

CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

EUVD-2026-93490

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

CVE-2026-105848

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

PT-2026-106780

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-stripe versions prior to 3.90.0 @payloadcms/plugin-stripe versions prior to 4.0.0-canary.34 Description An authenticated user can perform unintended Stripe operations by accessing the enabled optional Stripe REST proxy. This...

CVE-2026-105848: Exposed Dangerous Method or Function

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

EUVD-2026-65699

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

CVE-2026-79787 Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

CVE-2026-79787

CVE-2026-79787 affects Alluxio through 2.9.5 in its S3 REST Proxy component. In the default configuration, the proxy fails to verify AWS Signature Version 4 request signatures, allowing unauthenticated network attackers to extract usernames from unsigned Authorization headers and impersonate any ...

CVE-2026-79787

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

CVE-2026-79787 Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

CVE-2026-79787: Improper Authentication

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

CLEANSTART-2026-JZ53476 Security fixes in kserve-rest-proxy 0.12.0-r1

Package kserve-rest-proxy version 0.12.0-r1 fixes 6 vulnerabilities: CVE-2025-68121, CVE-2026-27142, CVE-2026-25679, CVE-2025-58190, CVE-2025-47911...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: migrate, kbld, harbor-cli, oauth2-proxy, terraform-provider-tls, php-fpmexporter, spire-server, timestamp-authority, envoy-gateway, terraform-provider-time, grpc-health-probe, logstash-exporter, dapr, rabbitmq-messaging-topology-operator, maru, sbom-convert, dgraph,...

CLEANSTART-2026-HK71313 Security fixes for CVE-2025-47911, CVE-2025-58190, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-qxp5-gwg8-xv66, ghsa-vvgc-356p-c3xw applied in versions: 0.12.0-r0, 0.12.0-r1, 0.12.0-r2

Multiple security vulnerabilities affect the kserve-rest-proxy package. These issues are resolved in later releases. See references for individual vulnerability details...