https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 19:22:53 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-105868 <p>Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.</p> <p>Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.</p> https://db.gcve.eu/vuln/fkie_cve-2026-105868 https://db.gcve.eu/vuln/ghsa-9qpg-3cf8-w33x <p><strong>Affected:</strong> npm: payload</p> <p>### Impact Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file.</p> <p>You are affected if: - You accept XML uploads (accepted by default).</p> <p>### Patches Users should upgrade Payload packages to `&gt;= 3.90.0` or `&gt;= 4.0.0-canary.34`.</p> <p>### Workarounds Disallow XML/XSL uploads.</p> <p><strong>Affected:</strong> npm: payload</p> <p>### Impact Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file.</p> <p>You are affected if: - You accept XML uploads (accepted by default).</p> <p>### Patches Users should upgrade Payload packages to `&gt;= 3.90.0` or `&gt;= 4.0.0-canary.34`.</p> <p>### Workarounds Disallow XML/XSL uploads.</p> https://db.gcve.eu/vuln/ghsa-9qpg-3cf8-w33x