Security advisories

critical2026-10-06

CVE-2026-105844-Payload: Prototype pollution in Payload Import Export plugin

View chart →

payloadcms/payload · GHSA-qf28-8hc6-vwrp

critical2026-10-06

CVE-2026-105845-Payload: SQL Injection in SQLite and Postgres

View chart →

payloadcms/payload · GHSA-v49j-62m6-pgrr

medium2026-10-06

CVE-2026-105846-Payload: Untrusted redirect URL parameter exploit

View chart →

payloadcms/payload · GHSA-w84c-53h3-mc2g

high2026-10-06

CVE-2026-105847-Payload: Polymorphic join queries could disclose hidden fields

View chart →

payloadcms/payload · GHSA-fpww-c55p-cjv6

medium2026-10-06

CVE-2026-105804-Payload: Password hashes use insufficient PBKDF2 iterations

View chart →

payloadcms/payload · GHSA-q6mq-ch85-c8mm

medium2026-10-06

CVE-2026-105805-Payload: Sort queries could expose protected field information

View chart →

payloadcms/payload · GHSA-9g87-32v6-3c2r

low2026-10-06

CVE-2026-105795-Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

View chart →

microsoft/kiota · GHSA-6gw6-rv2g-25mg

high2026-10-06

CVE-2026-105796-Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators

View chart →

microsoft/kiota · GHSA-rm89-rhwj-9j92

high2026-10-06

CVE-2026-104850-MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

View chart →

modelcontextprotocol/typescript-sdk · GHSA-6qxp-vccf-f47h

low2026-10-06

CVE-2026-105800-i18next-http-backend incomplete URL validation permits SSRF

View chart →

i18next/i18next-http-backend · GHSA-xvq9-wjp8-hwqf

critical2026-10-06

CVE-2026-105794-MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

View chart →

microsoft/msquic · GHSA-w5f4-fx9m-m4q7

high2026-10-06

CVE-2026-105801-openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

View chart →

openapi-generators/openapi-python-client · GHSA-5293-mq8x-g3xj

low2026-10-06

CVE-2026-105799-LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values

View chart →

langchain-ai/langchainjs · GHSA-5x6v-p487-7qh2

high2026-10-06

CVE-2026-26287-External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

View chart →

external-secrets/external-secrets · GHSA-q7hv-xx6h-q2x8

medium2026-10-06

Vyper: Memory corruption using function calls within tuples / nested calls

View chart →

vyperlang/vyper · GHSA-2r3x-4mrv-mcxf

medium2026-10-06

Vyper: Call stack corruption when passing complex type containing non-base type members as argument

View chart →

vyperlang/vyper · GHSA-4v7v-gqf9-ww2g

medium2026-10-06

Vyper: Return inside for loop more than 1 level deep

View chart →

vyperlang/vyper · GHSA-vg88-3v92-rjx2

high2026-10-06

sharp : Vulnerability in librsvg dependency CVE-2026-96889

View chart →

lovell/sharp · GHSA-wq5f-xc86-pv6w

medium2026-10-06

CVE-2026-105747-Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

View chart →

docling-project/docling · GHSA-3cr3-8m4c-fpxw

critical2026-10-06

CVE-2026-102422-shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

View chart →

ljharb/shell-quote · GHSA-pqg4-j6r4-53mv