https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T19:35:37.663956+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-280245 EUVD-2026-280245 2026-10-05T19:35:37.714823+00:00 EUVD-2026-280245 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34747 fkie_cve-2026-34747 2026-10-05T19:35:37.714881+00:00

Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patched in version 3.79.1.

 https://cve.radiocsirt.org/vuln/ghsa-7xxh-373w-35vg GHSA-7xxh-373w-35vg — Payload has an SQL Injection via Query Handling 2026-10-05T19:35:37.714943+00:00

Affected: npm: payload

### Impact

Certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.

### Patches

This issue has been fixed in **v3.79.1** and later. Query input validation has been hardened.

Upgrade to **v3.79.1 or later**.

### Workarounds

Until developers can upgrade:

- Limit access to endpoints that accept dynamic query inputs to trusted users only. - Validate or sanitize input from untrusted clients before sending it to query endpoints.