https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 19:36:15 +0000 https://db.gcve.eu/vuln/cve-2026-105856 <p><strong>Affected:</strong> payloadcms payload, @payloadcms db-d1-sqlite, @payloadcms db-postgres, @payloadcms db-sqlite, @payloadcms db-vercel-postgres</p> <p>Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite packages are fixed in versions 3.90.0 and 4.0.0-canary.34, and the Postgres packages are fixed in version 3.73.0.</p> <p><strong>Affected:</strong> payloadcms payload, @payloadcms db-d1-sqlite, @payloadcms db-postgres, @payloadcms db-sqlite, @payloadcms db-vercel-postgres</p> <p>Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite packages are fixed in versions 3.90.0 and 4.0.0-canary.34, and the Postgres packages are fixed in version 3.73.0.</p> https://db.gcve.eu/vuln/cve-2026-105856