## Impact
A readable collection could expose information about protected documents in a related collection.
**You are affected if:**
- You expose a readable collection with a relationship to a collection protected by access.read where constraints.
## Patches
Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
## Workarounds
There is no complete workaround. Upgrade Payload packages `>= 3.90.0` or `>= 4.0.0-canary.34`.
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
## Impact
When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions.
You are affected if:
- You use `@payloadcms/plugin-ecommerce` with the Stripe payment adapter.
Deployments that do not use the Stripe payment flow are not affected.
## Patches
Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
## Workarounds
Ensure Stripe order confirmations can only be processed once. This is a temporary mitigation; upgrading to a patched version is recommended.
### Impact
Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled.
You are affected if:
- An authentication collection enables `useAPIKey`.
- Users have read access to other user documents containing active API keys.
### Patches
Users should upgrade payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
### Workarounds
Disable `useAPIKey` or restrict users to reading only their own authentication document. Rotate any API key that may have been exposed.
### Summary
In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to.
A malicious or compromised MCP server could name its own authorization server. With no user interaction, the client would send it:
- the `refresh_token` and `client_secret` stored from an earlier sign-in
- the `client_secret` or signed assertion configured on a bundled provider
### Am I affected?
Yes, if both of these hold:
- your application uses the SDK's OAuth client over HTTP, through any of:
- an `authProvider` on a transport
- the `withOAuth()` middleware
- direct calls to `auth()` or `fetchToken()`
- it may connect to an MCP server you do not fully trust while holding credentials for a legitimate authorization server
Affected versions:
- `@modelcontextprotocol/sdk` 1.12.0 through 1.30.1
- `@modelcontextprotocol/client` 2.0.0 through 2.1.0, only for:
- bundled providers without `expectedIssuer`
- credentials stored or supplied without `issuer`
- direct calls to `fetchToken()`
- providers that read storage back through `OAuthTokensSchema` or `OAuthClientInformationSchema`
Not affected:
- MCP servers built with the SDK
- stdio clients
### Fix
Upgrade to:
- 1.x: `@modelcontextprotocol/sdk` 1.31.0 or later
- 2.x: `@modelcontextprotocol/client` 2.2.0 or later, and `@modelcontextprotocol/core` 2.2.0 or later if you import it directly
The client now records the authorization server as `issuer` on saved credentials and does not send them to a different one. The user signs in again, or the call throws.
In the following cases, upgrading to the patched version is not enough. You also need to make a change:
- **Bundled providers** (`ClientCredentialsProvider`, `PrivateKeyJwtProvider`, `StaticPrivateKeyJwtProvider`, `CrossAppAccessProvider`): pass `expectedIssuer`, for example `expectedIssuer: 'https://auth.example.com'`. Without it they still use whichever authorization server the MCP server names.
- **Credentials saved without `issuer`:** tokens and client information your `OAuthClientProvider` persisted (file, keychain, database) before upgrading, including everything 1.x saved before 1.31.0. They still go to whichever authorization server is named at first use. Add `issuer` to them, or clear them so users sign in again.
- **Your own `OAuthClientProvider`:** save exactly what `saveTokens()` and `saveClientInformation()` are given, including `issuer`. For pre-registered credentials, include `issuer` in what `clientInformation()` returns.
Not covered by this fix:
- a new interactive sign-in, which still goes to the authorization server the MCP server names. Only complete sign-ins for servers you trust.
- `refreshAuthorization()` and `exchangeAuthorization()` called directly
- 2.x with `skipIssuerMetadataValidation: true`
If an affected client may have connected to an untrusted MCP server, rotate its client secret or signing key and revoke its tokens.
If you cannot upgrade yet, connect OAuth clients only to MCP servers you trust. 2.0.0 and 2.1.0 already accept `expectedIssuer`.
PayloadCMS versions before 3.90.0 and canary versions before 4.0.0-canary.34 contain a vulnerability in the optional Stripe REST proxy plugin. Authenticated users with access to this proxy can perform unintended Stripe operations. This issue is addressed in versions 3.90.0 and 4.0.0-canary.34.
### Impact
A user with query access could use polymorphic join filters to infer hidden or read-restricted field values, including password-reset tokens.
You are affected if:
- You use an affected Payload version.
- Users can query a collection with a polymorphic join to sensitive fields.
### Patches
Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
### Workarounds
There is no complete workaround. Restricting read access to sensitive collections reduces exposure but does not replace upgrading.
### Impact
Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating.
### Patches
Users should upgrade Payload packages to `>= 3.88.0` or `>= 4.0.0-canary.27`.
### Workarounds
Upgrading is recommended. Until then, remove user-controlled redirect values from authentication flows or restrict them to known local paths.
CVE-2026-105957 is a medium severity SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in an unspecified function within the file /opils/admin/view_product.php, where manipulation of the 'Category' argument allows SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. Public exploit code is available, but no official patch or remediation guidance has been provided yet.
This content discusses how frontier AI models are transforming vulnerability management, particularly for Microsoft software. AI accelerates vulnerability discovery and patch development, resulting in a significant increase in identified vulnerabilities, especially for on-premises Microsoft products. Microsoft mitigates most cloud vulnerabilities without customer action, but on-premises customers should expect more frequent and numerous patches. CISOs face challenges balancing rapid patching with accuracy at unprecedented scale. The post recommends increased patching resources, faster patch deployment for critical systems, use of AI-powered scanning harnesses, and defense-in-depth strategies. Microsoft also collaborates with industry peers to address open-source vulnerabilities and promotes Secure by Design and Secure by Default principles to improve security posture.
### Impact
A user can submit a request that exploits a SQL Injection vulnerability in Payload.
You are affected if:
- You use an affected Payload version.
- Untrusted users can query readable collections using dynamic filters or joins.
You are not affected if you use MongoDB (`@payloadcms/mongodb`).
### Patches
Users should upgrade Payload packages to `>= 3.88.0` or `>= 4.0.0-canary.27`.
### Workarounds
Upgrading to a patched version is recommended. Until you can upgrade, restrict untrusted users from supplying dynamic query filters or join parameters and limit read access to affected collections.
PayloadCMS versions from 3.0.0 up to but not including 3.88.0, and canary versions from 4.0.0-canary.0 up to but not including 4.0.0-canary.27, contain a prototype pollution vulnerability in the @payloadcms/plugin-import-export plugin. This vulnerability allows unauthenticated users to submit prototype-sensitive field paths, leading to unintended application behavior and potential remote code execution. The issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
### Impact
Under certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover.
Applications that do not use `@payloadcms/plugin-mcp` are not affected.
### Patches
Users should upgrade to `@payloadcms/plugin-mcp` version `3.88.0` or later.
### Workarounds
Upgrading is recommended. Until then, disable the MCP plugin or restrict MCP API-key management to trusted users.
Dell Container Storage Modules versions prior to 1.18.0 have a Missing Authentication for Critical Function vulnerability (CVE-2026-63692). This flaw allows an unauthenticated remote attacker to potentially elevate privileges. The vulnerability has a critical severity with a CVSS score of 10. No patch or remediation information is provided in the available data.
A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-91140 is a critical OS command injection vulnerability in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0. It arises from shell-based temporary-file cleanup instructions that improperly handle user-supplied Swagger/OpenAPI documents. An attacker can exploit this flaw to execute arbitrary commands on a developer's machine when the generator is invoked.
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection.
This issue affects SambaBox: before 5.4.1.
A SQL injection vulnerability exists in the Kusalkasilva Learning-Management-System in the student_signup.php file's Student Registration Endpoint. This vulnerability allows remote attackers to manipulate SQL queries, potentially impacting confidentiality, integrity, and availability. The vulnerability has been publicly disclosed, but no official response or patch from the project is available yet. The product uses a rolling release model, so specific affected versions are not identified. The CVSS score is 7.3, indicating a medium severity risk.
Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page.
Rundeck versions prior to 6.2.0 have a path traversal vulnerability that allows users with project configure ACL permissions to read arbitrary files on the server. By setting a configuration parameter to an absolute file path, attackers can access sensitive data such as database passwords and LDAP credentials via specific API endpoints. This vulnerability has a CVSS score of 6.5, indicating a high severity risk.