https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 01:55:03 +0000 https://vulnerability.circl.lu/sighting/21ddf2df-003d-4349-a66c-b8b13a85aa79/export {"uuid": "21ddf2df-003d-4349-a66c-b8b13a85aa79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105845", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxbmjgtniv2n", "content": "CVE-2026-105845 - payload\nVersions of the Payload content management system earlier than 3.88.0 (and certain early canary builds) let a user who can view data craft a request that inserts\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#payload #elliotpayload #npm #CVE #infosec", "creation_timestamp": "2026-10-07T09:20:04.784958Z"} {"uuid": "21ddf2df-003d-4349-a66c-b8b13a85aa79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105845", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxbmjgtniv2n", "content": "CVE-2026-105845 - payload\nVersions of the Payload content management system earlier than 3.88.0 (and certain early canary builds) let a user who can view data craft a request that inserts\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#payload #elliotpayload #npm #CVE #infosec", "creation_timestamp": "2026-10-07T09:20:04.784958Z"} https://vulnerability.circl.lu/sighting/21ddf2df-003d-4349-a66c-b8b13a85aa79/export Wed, 07 Oct 2026 09:20:04 +0000 https://vulnerability.circl.lu/sighting/be65acd0-6725-4fc3-8e46-5dea58ab4c4e/export {"uuid": "be65acd0-6725-4fc3-8e46-5dea58ab4c4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105845", "type": "seen", "source": "https://gist.github.com/alon710/5894e68c3b84bb07715c82c127281f5d", "content": "# CVE-2026-105845: CVE-2026-105845: SQL Injection and Access Control Bypass in Payload CMS Adapters via Case-Sensitivity Flaws and Sorting\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105845\n\n## Summary\nA critical SQL Injection and access control bypass vulnerability was identified in Payload CMS database adapters (SQLite and PostgreSQL using Drizzle ORM internally). The vulnerability arises from case-sensitive logical operator checks during path validation and unvalidated sort queries. This allows remote attackers to bypass access control rules, execute unauthorized queries, and retrieve sensitive data through blind SQL injection side channels.\n\n## TL;DR\nRemote attackers can bypass Payload CMS field access controls and perform blind SQL injection or unauthorized sorting by using capitalized logical operators like 'AND' or 'OR' and utilizing unvalidated query sorting parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.8 (Critical)\n- **Exploit Status**: PoC / Analytical\n- **KEV Status**: Not Listed\n- **Ransomware Use**: No\n\n## Affected Systems\n\n- Payload CMS (SQLite Adapter)\n- Payload CMS (Postgres Adapter)\n- Applications utilizing Drizzle ORM adapters within Payload CMS versions 3.0.0 up to 3.87.9\n- **payload**: >= 3.0.0, < 3.88.0 (Fixed in: `3.88.0`)\n- **payload**: >= 4.0.0-canary.0, < 4.0.0-canary.27 (Fixed in: `4.0.0-canary.27`)\n\n## Mitigation\n\n- Upgrade Payload CMS to version 3.88.0 or higher.\n- Configure WAF rules to block mixed-case or uppercase logical query keys (e.g., AND, OR, And).\n- Enforce strict least-privilege access rules at the database engine level.\n\n**Remediation Steps:**\n1. Identify vulnerable Payload CMS installations by inspecting package.json for versions between 3.0.0 and 3.87.9.\n2. Run `npm install payload@3.88.0` or update yarn/pnpm equivalent to pull the patched version.\n3. Verify that the fix is applied by attempting a test query using mixed-case logical operators and ensuring it is rejected with a validation error.\n4. Deploy the updated application to production and monitor API logs for blocked query formats.\n\n## References\n\n- [GitHub Security Advisory GHSA-v49j-62m6-pgrr](https://github.com/payloadcms/payload/security/advisories/GHSA-v49j-62m6-pgrr)\n- [Payload CMS Fix Commit a742140ab4fca3160f7f83e9e7d996552ffc3b5a](https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105845) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-07T04:30:30.000000Z"} {"uuid": "be65acd0-6725-4fc3-8e46-5dea58ab4c4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105845", "type": "seen", "source": "https://gist.github.com/alon710/5894e68c3b84bb07715c82c127281f5d", "content": "# CVE-2026-105845: CVE-2026-105845: SQL Injection and Access Control Bypass in Payload CMS Adapters via Case-Sensitivity Flaws and Sorting\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105845\n\n## Summary\nA critical SQL Injection and access control bypass vulnerability was identified in Payload CMS database adapters (SQLite and PostgreSQL using Drizzle ORM internally). The vulnerability arises from case-sensitive logical operator checks during path validation and unvalidated sort queries. This allows remote attackers to bypass access control rules, execute unauthorized queries, and retrieve sensitive data through blind SQL injection side channels.\n\n## TL;DR\nRemote attackers can bypass Payload CMS field access controls and perform blind SQL injection or unauthorized sorting by using capitalized logical operators like 'AND' or 'OR' and utilizing unvalidated query sorting parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.8 (Critical)\n- **Exploit Status**: PoC / Analytical\n- **KEV Status**: Not Listed\n- **Ransomware Use**: No\n\n## Affected Systems\n\n- Payload CMS (SQLite Adapter)\n- Payload CMS (Postgres Adapter)\n- Applications utilizing Drizzle ORM adapters within Payload CMS versions 3.0.0 up to 3.87.9\n- **payload**: >= 3.0.0, < 3.88.0 (Fixed in: `3.88.0`)\n- **payload**: >= 4.0.0-canary.0, < 4.0.0-canary.27 (Fixed in: `4.0.0-canary.27`)\n\n## Mitigation\n\n- Upgrade Payload CMS to version 3.88.0 or higher.\n- Configure WAF rules to block mixed-case or uppercase logical query keys (e.g., AND, OR, And).\n- Enforce strict least-privilege access rules at the database engine level.\n\n**Remediation Steps:**\n1. Identify vulnerable Payload CMS installations by inspecting package.json for versions between 3.0.0 and 3.87.9.\n2. Run `npm install payload@3.88.0` or update yarn/pnpm equivalent to pull the patched version.\n3. Verify that the fix is applied by attempting a test query using mixed-case logical operators and ensuring it is rejected with a validation error.\n4. Deploy the updated application to production and monitor API logs for blocked query formats.\n\n## References\n\n- [GitHub Security Advisory GHSA-v49j-62m6-pgrr](https://github.com/payloadcms/payload/security/advisories/GHSA-v49j-62m6-pgrr)\n- [Payload CMS Fix Commit a742140ab4fca3160f7f83e9e7d996552ffc3b5a](https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105845) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-07T04:30:30.000000Z"} https://vulnerability.circl.lu/sighting/be65acd0-6725-4fc3-8e46-5dea58ab4c4e/export Wed, 07 Oct 2026 04:30:30 +0000 https://vulnerability.circl.lu/sighting/81d4c8f3-9a3d-468d-b37a-5eb93c85efa1/export {"uuid": "81d4c8f3-9a3d-468d-b37a-5eb93c85efa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105845", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx7zkgxjju2h", "content": "\ud83d\udea8 CVE-2026-105845 \u2014 CVSS 9.8 CRITICAL\n\nPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105845\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-06T18:07:57.355318Z"} {"uuid": "81d4c8f3-9a3d-468d-b37a-5eb93c85efa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105845", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx7zkgxjju2h", "content": "\ud83d\udea8 CVE-2026-105845 \u2014 CVSS 9.8 CRITICAL\n\nPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105845\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-06T18:07:57.355318Z"} https://vulnerability.circl.lu/sighting/81d4c8f3-9a3d-468d-b37a-5eb93c85efa1/export Tue, 06 Oct 2026 18:07:57 +0000 https://vulnerability.circl.lu/sighting/dda1d9d5-ba12-418f-ae6d-db80c009dfb0/export {"uuid": "dda1d9d5-ba12-418f-ae6d-db80c009dfb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105845", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mx7uezwjvp2u", "content": "\ud83d\udd34 CVE-2026-105845 - Critical (9.8)\n\nPayload is a free and open source headless content management system. In versions from 3.0.0 befo...\n\nhttps://www.themasherwire.com/vulnerability/CVE-2026-105845/\n\n#infosec #potatosecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-06T16:35:27.306513Z"} {"uuid": "dda1d9d5-ba12-418f-ae6d-db80c009dfb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105845", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mx7uezwjvp2u", "content": "\ud83d\udd34 CVE-2026-105845 - Critical (9.8)\n\nPayload is a free and open source headless content management system. In versions from 3.0.0 befo...\n\nhttps://www.themasherwire.com/vulnerability/CVE-2026-105845/\n\n#infosec #potatosecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-06T16:35:27.306513Z"} https://vulnerability.circl.lu/sighting/dda1d9d5-ba12-418f-ae6d-db80c009dfb0/export Tue, 06 Oct 2026 16:35:27 +0000 https://vulnerability.circl.lu/sighting/1416b89e-093f-4da3-965f-943e126f4f6b/export {"uuid": "1416b89e-093f-4da3-965f-943e126f4f6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105845", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx7ueyb3bj2g", "content": "\ud83d\udd34 CVE-2026-105845 - Critical (9.8)\n\nPayload is a free and open source headless content management system. In versions from 3.0.0 befo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105845/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-06T16:35:26.000322Z"} {"uuid": "1416b89e-093f-4da3-965f-943e126f4f6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105845", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx7ueyb3bj2g", "content": "\ud83d\udd34 CVE-2026-105845 - Critical (9.8)\n\nPayload is a free and open source headless content management system. In versions from 3.0.0 befo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105845/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-06T16:35:26.000322Z"} https://vulnerability.circl.lu/sighting/1416b89e-093f-4da3-965f-943e126f4f6b/export Tue, 06 Oct 2026 16:35:26 +0000