https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:10:42 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-213160 EUVD-2026-213160 https://cve.radiocsirt.org/vuln/euvd-2026-213160 https://cve.radiocsirt.org/vuln/fkie_cve-2023-30843 <p>Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data.</p> <p>Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-30843 https://cve.radiocsirt.org/vuln/ghsa-35jj-vqcf-f2jf <p><strong>Affected:</strong> npm: payload</p> <p>### Details</p> <p>If a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force.</p> <p>Affected versions: &lt; 1.7.0</p> <p>### Workarounds</p> <p>If you are unable to update, you can write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data.</p> <p>### Detecting Compromise</p> <p>Monitor your instance for brute-force style requests against your instance using `where` queries.</p> <p><strong>Affected:</strong> npm: payload</p> <p>### Details</p> <p>If a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force.</p> <p>Affected versions: &lt; 1.7.0</p> <p>### Workarounds</p> <p>If you are unable to update, you can write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data.</p> <p>### Detecting Compromise</p> <p>Monitor your instance for brute-force style requests against your instance using `where` queries.</p> https://cve.radiocsirt.org/vuln/ghsa-35jj-vqcf-f2jf https://cve.radiocsirt.org/vuln/gsd-2023-30843 gsd-2023-30843 https://cve.radiocsirt.org/vuln/gsd-2023-30843