CVE Vulnerability Catalog

In JetBrains TeamCity before versions 2026.1.3 and 2025.11.7, a Kotlin DSL sandbox escape leading to remote code execution (RCE) on the server was possible. The vulnerability allows an attacker to execute arbitrary code in the context of the TeamCity server.

Quasar Framework before 2.22.0 has a vulnerability in the SSR-only getHead() serializer that fails to properly encode values supplied via useMeta(). An attacker who can influence dynamic page metadata can inject executable HTML markup before hydration. The client-side path is not affected because it uses DOM APIs that encode attributes.

In Quasar Framework prior to 2.32.2, the openURL() utility trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows.

In Payload CMS, the @payloadcms/db-mongodb adapter in versions before 3.87.0 and canary versions before 4.0.0-canary.20 allows an authenticated user who can update a document to modify fields that field-level write access control does not permit them to change. The Postgres and SQLite adapters are not affected.

SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in an unknown function of the file /opils/admin/view_product.php. Manipulation of the Category argument allows remote attack. The exploit is public.

In Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This leads to JavaScript execution in the victim's browser context.

In Payload CMS, the @payloadcms/storage-s3 package in versions before 3.90.0 and canary versions before 4.0.0-canary.34 allows an authenticated user to overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useCompositePrefixes is false or unset. This bypasses the target collection's access controls and prior file validation.

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in.

In Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to trusted users are less exposed.

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed.

Payload CMS in versions after 3.0.0 and before 3.90.0 allows a custom field option that maps a field to a reserved authentication claim name to place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.

In Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user downloads and opens the SVG. This leads to code execution in the victim's browser.

In Payload CMS versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to an unintended recipient. This issue is fixed in version 3.90.0.

The @payloadcms/plugin-multi-tenant plugin before versions 3.90.0 and canary before 4.0.0-canary.34 by default allows an authenticated user to assign their own account to other tenants. Deployments that replace the default behavior with secured tenants arrayFieldAccess.create and update functions are not affected. Fixed in versions 3.90.0 and 4.0.0-canary.34.

Payload CMS before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability that allows an attacker to modify collection documents without enforcing collection or field-level access control when orderable is enabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions before 3.90.0 and canary before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. Fixed in versions 3.90.0 and 4.0.0-canary.34.

The @payloadcms/plugin-form-builder plugin in versions before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability that allows an attacker to execute code remotely on the server via a crafted form submission. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions before 3.90.0 and 4.0.0-canary.34, an attacker with read and create/update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through crafted field paths and operators. Collections without those fields and richText fields are not affected. SQLite packages fixed in 3.90.0 and 4.0.0-canary.34, Postgres fixed in 3.73.0.

In Payload versions before 3.90.0 and canary before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. Fixed in versions 3.90.0 and 4.0.0-canary.34.