Medium
CVE-2026-107392
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
High
CVE-2026-107375
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
High
CVE-2026-107303
JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob
High
CVE-2026-105856
Payload: SQL injection in SQLite/Postgres
High
CVE-2026-105858
Payload: Remote Code Execution through first-register
High
CVE-2026-105860
Payload has a tenant authorization bypass in Multi-Tenant Plugin
High
CVE-2026-105861
Payload external upload trust validation issue
High
CVE-2026-105862
Payload: Bypassed sanitization of user uploaded SVGs
Medium
CVE-2026-105864
@payloadcms/plugin-multi-tenant has a cross-tenant create issue
High
CVE-2026-105865
Payload: Incomplete validation during the upload file lifecycle
Medium
CVE-2026-105866
Payload: Unauthenticated account-lockout denial of service
High
CVE-2026-105867
Payload: Client uploads could overwrite S3 objects
High
CVE-2026-105868
Payload: Uploaded XML files could execute same-origin JavaScript
Critical
CVE-2026-105857
Payload Form Builder has an RCE issue
Critical
CVE-2026-105859
Payload: Unauthorized update to collection documents
Critical
CVE-2026-105863
Payload authentication token field handling issue
Low
CVE-2026-106101
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
High
CVE-2026-104891
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
High
CVE-2026-106100
Payload: Field-level write access bypass in Payload on MongoDB
High
CVE-2026-106106
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
High
CVE-2026-106104
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
Critical
CVE-2026-106102
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
High
CVE-2026-86540
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
High
CVE-2026-105855
Payload didn't enforce field-level password update restrictions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.