https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 21:22:42 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-278824 EUVD-2026-278824 https://cve.radiocsirt.org/vuln/euvd-2026-278824 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34748 <p>Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. This issue has been patched in version 3.78.0.</p> <p>Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. This issue has been patched in version 3.78.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34748 https://cve.radiocsirt.org/vuln/ghsa-mmxc-95ch-2j7c <p><strong>Affected:</strong> npm: @payloadcms/next</p> <p>### Impact</p> <p>A stored Cross-site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser.</p> <p>Consumers are affected if ALL of these are true:</p> <p>- Payload version **&lt; v3.78.0** - At least one collection with versions enabled - An authenticated user has `create` or `update` access to that collection</p> <p>### Patches</p> <p>This vulnerability has been patched in **v3.78.0**. Output encoding has been added to prevent user-supplied content from being interpreted as markup.</p> <p>Users should upgrade to **v3.78.0** or later.</p> <p>### Workarounds</p> <p>If consumers cannot upgrade immediately:</p> <p>- Restrict `create` and `update` access to versioned collections to trusted roles only.</p> <p><strong>Affected:</strong> npm: @payloadcms/next</p> <p>### Impact</p> <p>A stored Cross-site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser.</p> <p>Consumers are affected if ALL of these are true:</p> <p>- Payload version **&lt; v3.78.0** - At least one collection with versions enabled - An authenticated user has `create` or `update` access to that collection</p> <p>### Patches</p> <p>This vulnerability has been patched in **v3.78.0**. Output encoding has been added to prevent user-supplied content from being interpreted as markup.</p> <p>Users should upgrade to **v3.78.0** or later.</p> <p>### Workarounds</p> <p>If consumers cannot upgrade immediately:</p> <p>- Restrict `create` and `update` access to versioned collections to trusted roles only.</p> https://cve.radiocsirt.org/vuln/ghsa-mmxc-95ch-2j7c