https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 08:20:57 +0000 https://vulnerability.circl.lu/sighting/d8a64dd4-f7b9-43f3-95c6-952183bdfe08/export {"uuid": "d8a64dd4-f7b9-43f3-95c6-952183bdfe08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105844", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/104591", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-105844\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-07 19:56:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-105844 \u2014 Payload CMS @payloadcms/plugin-import-export <3.88.0 unauth prototype pollution (CWE-1321, CVSS 4.0 9.3). PoCbit PoC: POST /api/exports/export-preview fields __proto__.overrideAccess \u2192 ACL bypass / data leak. check/exploit/mass. Fix 3.88.0+. https://pocbit.org/pocs/cve-2026-105844\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-07T20:00:08.000000Z"} {"uuid": "d8a64dd4-f7b9-43f3-95c6-952183bdfe08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105844", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/104591", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-105844\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-07 19:56:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-105844 \u2014 Payload CMS @payloadcms/plugin-import-export <3.88.0 unauth prototype pollution (CWE-1321, CVSS 4.0 9.3). PoCbit PoC: POST /api/exports/export-preview fields __proto__.overrideAccess \u2192 ACL bypass / data leak. check/exploit/mass. Fix 3.88.0+. https://pocbit.org/pocs/cve-2026-105844\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-07T20:00:08.000000Z"} https://vulnerability.circl.lu/sighting/d8a64dd4-f7b9-43f3-95c6-952183bdfe08/export Wed, 07 Oct 2026 20:00:08 +0000 https://vulnerability.circl.lu/sighting/4a8b1018-0e08-4b6d-973d-8485958ca9ae/export {"uuid": "4a8b1018-0e08-4b6d-973d-8485958ca9ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105844", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxblxlmfj32z", "content": "CVE-2026-105844 - plugin-import-export\nThe free Payload content management system and its import\u2011export plugin allow anyone on the internet to send specially crafted data that can make the application behave\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#payloadcms #npm #CVE #infosec", "creation_timestamp": "2026-10-07T09:10:05.924362Z"} {"uuid": "4a8b1018-0e08-4b6d-973d-8485958ca9ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105844", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxblxlmfj32z", "content": "CVE-2026-105844 - plugin-import-export\nThe free Payload content management system and its import\u2011export plugin allow anyone on the internet to send specially crafted data that can make the application behave\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#payloadcms #npm #CVE #infosec", "creation_timestamp": "2026-10-07T09:10:05.924362Z"} https://vulnerability.circl.lu/sighting/4a8b1018-0e08-4b6d-973d-8485958ca9ae/export Wed, 07 Oct 2026 09:10:05 +0000 https://vulnerability.circl.lu/sighting/db6dd8a6-e6c7-4494-865d-7eda8c74e6a8/export {"uuid": "db6dd8a6-e6c7-4494-865d-7eda8c74e6a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105844", "type": "seen", "source": "https://gist.github.com/alon710/3583dedc8f73c0d4a0175e520c5ec25d", "content": "# CVE-2026-105844: CVE-2026-105844: Remote Code Execution via Prototype Pollution in @payloadcms/plugin-import-export\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105844\n\n## Summary\nA critical prototype pollution vulnerability in the import-export plugin of Payload CMS allows unauthenticated remote attackers to bypass access controls and achieve remote code execution.\n\n## TL;DR\nUnauthenticated remote attackers can pollute the global object prototype in Payload CMS to bypass access controls and execute arbitrary code on the server.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.3 (Critical)\n- **EPSS Score**: N/A\n- **Impact**: Remote Code Execution (RCE) / Privilege Escalation\n- **Exploit Status**: Proof of Concept (PoC) documented\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Payload CMS instances running @payloadcms/plugin-import-export < 3.88.0\n- **Payload CMS (@payloadcms/plugin-import-export)**: >= 3.0.0, < 3.88.0 (Fixed in: `3.88.0`)\n- **Payload CMS (canary)**: < 4.0.0-canary.27 (Fixed in: `4.0.0-canary.27`)\n\n## Mitigation\n\n- Upgrade to Payload CMS v3.88.0 or 4.0.0-canary.27\n- Deploy Web Application Firewall (WAF) signatures to block request payloads containing __proto__ or constructor paths\n- Restrict network access to export preview endpoints if they are not strictly required for external operations\n\n**Remediation Steps:**\n1. Run 'npm install payload@3.88.0 @payloadcms/plugin-import-export@3.88.0' to upgrade the monorepo.\n2. Verify the installation using 'npm list payload @payloadcms/plugin-import-export'.\n3. Restart the node application to apply the code changes in-memory.\n\n## References\n\n- [GHSA-qf28-8hc6-vwrp Advisory](https://github.com/payloadcms/payload/security/advisories/GHSA-qf28-8hc6-vwrp)\n- [NVD CVE-2026-105844](https://nvd.nist.gov/vuln/detail/CVE-2026-105844)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105844) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-07T03:30:29.000000Z"} {"uuid": "db6dd8a6-e6c7-4494-865d-7eda8c74e6a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105844", "type": "seen", "source": "https://gist.github.com/alon710/3583dedc8f73c0d4a0175e520c5ec25d", "content": "# CVE-2026-105844: CVE-2026-105844: Remote Code Execution via Prototype Pollution in @payloadcms/plugin-import-export\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105844\n\n## Summary\nA critical prototype pollution vulnerability in the import-export plugin of Payload CMS allows unauthenticated remote attackers to bypass access controls and achieve remote code execution.\n\n## TL;DR\nUnauthenticated remote attackers can pollute the global object prototype in Payload CMS to bypass access controls and execute arbitrary code on the server.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.3 (Critical)\n- **EPSS Score**: N/A\n- **Impact**: Remote Code Execution (RCE) / Privilege Escalation\n- **Exploit Status**: Proof of Concept (PoC) documented\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Payload CMS instances running @payloadcms/plugin-import-export < 3.88.0\n- **Payload CMS (@payloadcms/plugin-import-export)**: >= 3.0.0, < 3.88.0 (Fixed in: `3.88.0`)\n- **Payload CMS (canary)**: < 4.0.0-canary.27 (Fixed in: `4.0.0-canary.27`)\n\n## Mitigation\n\n- Upgrade to Payload CMS v3.88.0 or 4.0.0-canary.27\n- Deploy Web Application Firewall (WAF) signatures to block request payloads containing __proto__ or constructor paths\n- Restrict network access to export preview endpoints if they are not strictly required for external operations\n\n**Remediation Steps:**\n1. Run 'npm install payload@3.88.0 @payloadcms/plugin-import-export@3.88.0' to upgrade the monorepo.\n2. Verify the installation using 'npm list payload @payloadcms/plugin-import-export'.\n3. Restart the node application to apply the code changes in-memory.\n\n## References\n\n- [GHSA-qf28-8hc6-vwrp Advisory](https://github.com/payloadcms/payload/security/advisories/GHSA-qf28-8hc6-vwrp)\n- [NVD CVE-2026-105844](https://nvd.nist.gov/vuln/detail/CVE-2026-105844)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105844) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-07T03:30:29.000000Z"} https://vulnerability.circl.lu/sighting/db6dd8a6-e6c7-4494-865d-7eda8c74e6a8/export Wed, 07 Oct 2026 03:30:29 +0000 https://vulnerability.circl.lu/sighting/bbf8b4e1-aa57-4e9b-be63-4d8a9521922b/export {"uuid": "bbf8b4e1-aa57-4e9b-be63-4d8a9521922b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105844", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx7zk6wxkd2z", "content": "\ud83d\udea8 CVE-2026-105844 \u2014 CVSS 9.3 CRITICAL\n\nPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105844\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-06T18:07:49.071627Z"} {"uuid": "bbf8b4e1-aa57-4e9b-be63-4d8a9521922b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105844", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx7zk6wxkd2z", "content": "\ud83d\udea8 CVE-2026-105844 \u2014 CVSS 9.3 CRITICAL\n\nPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105844\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-06T18:07:49.071627Z"} https://vulnerability.circl.lu/sighting/bbf8b4e1-aa57-4e9b-be63-4d8a9521922b/export Tue, 06 Oct 2026 18:07:49 +0000