CVE Vulnerability Catalog

In Payload CMS, the @payloadcms/storage-s3 package in versions before 3.90.0 and canary versions before 4.0.0-canary.34 allows an authenticated user to overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useCompositePrefixes is false or unset. This bypasses the target collection's access controls and prior file validation.

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot access. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset tokens, through polymorphic join filters. Fixed in versions 3.90.0 and 4.0.0-canary.34.

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes.

Dbit WIFI4 N300 devices version 1.0.0 allow administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Unauthorized access.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read.

Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test recovered password hashes.

A security flaw has been discovered in vllm-project vLLM up to 0.31.0, affecting the function get_token_bin_counts_and_mask in the file vllm/model_executor/layers/utils.py of the Penalty Handler component. Manipulation results in denial of service. Remote exploitation is possible, and the exploit has been publicly released.

A vulnerability was identified in Kusalkasilva Learning-Management-System up to version ffeb873f8803f1e9664384ff75000c7da45466d2, affecting an unknown function in the file search_class.php. Manipulation of the argument school_year leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

In Microsoft UFO before version 3.0.9, the /api/task_result/{task_name} endpoint calls SessionManager.get_result_by_task() in ufo/server/services/session_manager.py, which acquires a non-reentrant lock and then attempts to acquire the same lock again when the task name maps to a session. An authenticated attacker can block the request indefinitely, and in the default single-process configuration, the blocked event-loop thread prevents other HTTP, WebSocket, and dependent background interactions.

A vulnerability in ESET PROTECT On-Prem involves allocation of resources without limits or throttling, leading to increased CPU and RAM consumption and potentially enabling a Denial-of-Service attack.

In Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18, the function django.forms.models.BaseModelFormSet.save_existing_objects() used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An object outside that queryset can be deleted by an authenticated user without permission on the targeted object, via forged management-form data. Models using the default AutoField primary key are not affected.

In Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18, an incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply bytes values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source.

In Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18, the function django.utils.http.parse_header_parameters() is subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this parsing through headers such as Accept or Content-Type.

A vulnerability in Expert Mail by Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. involves improper control of interaction frequency, allowing brute force attacks. This issue affects Expert Mail through 2026-09-18.

In Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18, the function django.utils.translation.get_supported_language_variant() is subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory.