Veille CVE

Mardi 6 octobre 2026

1 CVE

Critique 0 Élevée 1 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « @payloadcms db-postgres » ✕
  1. CVE-2026-105856 8.3 Élevée

    payloadcms payload · @payloadcms db-d1-sqlite · @payloadcms db-postgres · @payloadcms db-sqlite

    Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite packages are fixed in versions 3.90.0 and 4.0.0-canary.34, and the Postgres packages are fixed in version 3.73.0.