Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,655 results · page 4 of 54
Oct 9, 2026Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc.CVE-2026-86405 · Websites & servers · reported by iletisim@usom.gov.trCritical 9.8
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc.CVE-2026-85531 · Other software · Sipay Electronic Money and Payment Services Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.
- Product
- OpenCart Virtual POS Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Super Payments: Does not properly verify the authenticity of incoming payment webhook notificationsCVE-2026-103329 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.
- Product
- Super Payments
- Fixed in
- 1.43.1
- What to do
- Update Super Payments to 1.43.1 or newer.
Oct 9, 2026Simple Payment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96332 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through 2.5.4.
- Product
- Simple Payment
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update Simple Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026JNews - Pay Writer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96328 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1.
- Product
- JNews - Pay Writer
- Affected
- up to 12.0.1
- What to do
- Affects up to 12.0.1. Update JNews - Pay Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Deposits and Partial Payments for WooCommerce: Missing AuthorizationCVE-2026-95589 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n/a through 4.0.1.
- Product
- Deposits and Partial Payments for WooCommerce
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Deposits and Partial Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Pay with Vipps for WooCommerce: Deserialization of Untrusted DataCVE-2026-94568 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.
- Product
- Pay with Vipps for WooCommerce
- Affected
- up to 6.2.0
- What to do
- Affects up to 6.2.0. Update Pay with Vipps for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026UnitechPay: Does not verify the authenticity of the payment notifications it receivesCVE-2026-87841 · WordPress plugins & themes · reported by WPScanMedium 5.3
The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state.
- Product
- UnitechPay
- Affected
- up to 1.0.6.3
- What to do
- Affects up to 1.0.6.3. Update UnitechPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error.CVE-2026-106434 · Other software · MongoDB · reported by cna@mongodb.comMedium 5.3
The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.
- Product
- libmongocrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitializCVE-2026-107676 · Other software · FFmpeg · reported by VulnCheckMedium 4.8
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files.
- Product
- FFmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.ffmpeg.orgcode.ffmpeg.org
Oct 8, 2026SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loadCVE-2026-93034 · Other software · SGLang · reported by cret@cert.orgCritical 9.8
SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled with a non-loopback --dist-init-addr setting.
- Product
- SGLang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membersCVE-2026-107636 · Other software · ph7software · reported by VulnCheckHigh 7.1
pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item_number, cart_order_id, or the PayPal custom field while paying a token amount, or submit uncompleted PayPal IPN payments, to gain the most expensive membership and its paid features.
- Product
- ph7builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Airwallex Online Payments Gateway: Does not verify that an incoming payment notification genuinely comes from the payment providerCVE-2026-103517 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.
- Product
- Airwallex Online Payments Gateway
- Fixed in
- 1.36.0
- What to do
- Update Airwallex Online Payments Gateway to 1.36.0 or newer.
Oct 7, 2026ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without fCVE-2026-19186 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgHigh 8.1
ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without first checking that the received frame is at least ll_hdr_len + authtag_len bytes long. All three variables are uint8_t, so a frame whose payload is shorter than the configured authentication tag makes the subtraction wrap around to a large value (up to 255). The wrapped length is passed unchanged to ieee802154_decrypt_auth() and on to the CCM operation as cipher_pkt.in_len/out_buf_max, with apkt->tag pointing at frame + ll_hdr_len + payload_len. Because the receive buffer is allocated to the exact length of the frame received from the radio driver, the crypto layer then reads several hundred bytes past the end of the packet buffer and writes the same number of decrypted bytes back over it in place. The frame's authentication tag is only verified after this processing has taken place, so no key material, association or prior authentication is needed — a single crafted short frame from any device in radio range is sufficient. Frame validation in ieee802154_validate_frame() does not prevent it: a data frame is accepted with a
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint.CVE-2026-107102 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an authenticated session for an arbitrary user without valid payment verification. Successful exploitation of this vulnerability could allow the attacker to bypass authentication and gain unauthorized access to other user accounts on the targeted system.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026Nexi XPay Build: Does not correctly validate the security token on its payment notification routeCVE-2026-82212 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.
- Product
- Nexi XPay Build
- Affected
- up to 7.6.2
- What to do
- Affects up to 7.6.2. Update Nexi XPay Build to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Nexi XPay Build: Does not verify the payment result supplied to several of its unauthenticated routesCVE-2026-82211 · WordPress plugins & themes · reported by WPScanHigh 8.2
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
- Product
- Nexi XPay Build
- Affected
- up to 7.6.2
- What to do
- Affects up to 7.6.2. Update Nexi XPay Build to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Yaad Sarig Payment Gateway For WC: Does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actionsCVE-2026-104651 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.
- Product
- Yaad Sarig Payment Gateway For WC
- Fixed in
- 2.2.13
- What to do
- Update Yaad Sarig Payment Gateway For WC to 2.2.13 or newer.
Oct 6, 2026Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.CVE-2026-106360 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Oct 6, 2026Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information viaCVE-2026-106334 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Oct 6, 2026UI misrepresentation in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafCVE-2026-106276 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.4
UI misrepresentation in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-106100 · Other software · payloadcms · reported by GitHubHigh 7.1
Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105868 · Other software · payloadcms · reported by GitHubHigh 8.6
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105867 · Other software · payloadcms · reported by GitHubHigh 7.1
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useCompositePrefixes is false or unset. This bypasses the target collection's access controls and prior file validation. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105866 · Other software · payloadcms · reported by GitHubMedium 6.9
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105865 · Other software · payloadcms · reported by GitHubHigh 8.1
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to trusted users are less exposed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105864 · Other software · payloadcms · reported by GitHubMedium 5.3
Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105863 · Other software · payloadcms · reported by GitHubCritical 9.2
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105862 · Other software · payloadcms · reported by GitHubHigh 8.7
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user downloads and opens the SVG. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105861 · Other software · payloadcms · reported by GitHubHigh 7.2
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to an unintended recipient. This issue is fixed in version 3.90.0.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105860 · Other software · payloadcms · reported by GitHubHigh 7.1
Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants. Deployments that replace the default behavior with secured tenants arrayFieldAccess.create and tenants arrayFieldAccess.update functions are not affected by this behavior. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105859 · Other software · payloadcms · reported by GitHubCritical 9.8
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105858 · Other software · payloadcms · reported by GitHubHigh 8.1
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105857 · Other software · payloadcms · reported by GitHubCritical 10
Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105856 · Other software · payloadcms · reported by GitHubHigh 8.6
Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite packages are fixed in versions 3.90.0 and 4.0.0-canary.34, and the Postgres packages are fixed in version 3.73.0.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105855 · Other software · payloadcms · reported by GitHubHigh 7.6
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105854 · Other software · payloadcms · reported by GitHubHigh 8.7
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105853 · Other software · payloadcms · reported by GitHubHigh 7.1
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot access. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105852 · Other software · payloadcms · reported by GitHubMedium 6.9
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105851 · Other software · payloadcms · reported by GitHubCritical 9.3
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105850 · Other software · payloadcms · reported by GitHubHigh 8.8
Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105849 · Other software · payloadcms · reported by GitHubHigh 7.7
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105848 · Other software · payloadcms · reported by GitHubMedium 6.4
Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105847 · Other software · payloadcms · reported by GitHubHigh 7.1
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset tokens, through polymorphic join filters. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105846 · Other software · payloadcms · reported by GitHubMedium 6.1
Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105845 · Other software · payloadcms · reported by GitHubCritical 9.8
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105844 · Other software · payloadcms · reported by GitHubCritical 9.3
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105806 · Other software · payloadcms · reported by GitHubHigh 8.6
Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version 3.88.0.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105805 · Other software · payloadcms · reported by GitHubMedium 6.9
Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105804 · Other software · payloadcms · reported by GitHubMedium 5.7
Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test recovered password hashes. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.