CVE-2026-105806

Publié : 6 octobre 2026

Modifié : 6 octobre 2026

Description détaillée

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version 3.88.0.

Références et Patchs

https://github.com/payloadcms/payload/commit/025581d8c5ed836039ad85397288a30f0d3c11c1 https://github.com/payloadcms/payload/releases/tag/v3.88.0 https://github.com/payloadcms/payload/security/advisories/GHSA-2q76-m6w6-qgc6

Dernières Vulnérabilités

CVE-2026-95153

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints

VOIR DÉTAILS

CVE-2026-95140

kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create arbitrary directories and write arbitrary files outside the intended fileDir root via a crafted multipart request

VOIR DÉTAILS

CVE-2026-106219

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server

VOIR DÉTAILS