[ Vendor · 38 CVEs ]
payloadcms
CVEs affecting payloadcms published in the last 30 days, plus any payloadcms CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-105867 | 6 Oct 2026 | CVSS 6.5 | Payload: Client uploads could overwrite S3 objectsPayload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105867 | 6 Oct 2026 | CVSS 6.5 | Payload: Client uploads could overwrite S3 objectsPayload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105868 | 6 Oct 2026 | CVSS 7.1 | Payload: Uploaded XML files could execute same-origin JavaScriptPayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local… | Fix |
| CVE-2026-106100 | 6 Oct 2026 | CVSS 7.1 | Payload: Field-level write access bypass in Payload on MongoDBPayload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before… | Fix |
| CVE-2026-105860 | 6 Oct 2026 | CVSS 7.1 | Payload has a tenant authorization bypass in Multi-Tenant PluginPayload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions… | Fix |
| CVE-2026-105861 | 6 Oct 2026 | CVSS 8.2 | Payload external upload trust validation issuePayload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based… | Fix |
| CVE-2026-105862 | 6 Oct 2026 | CVSS 8.7 | Payload: Bypassed sanitization of user uploaded SVGsPayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a… | Fix |
| CVE-2026-105863 | 6 Oct 2026 | CVSS 9.4 | Payload authentication token field handling issuePayload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a… | Fix |
| CVE-2026-105864 | 6 Oct 2026 | CVSS 4.3 | @payloadcms/plugin-multi-tenant has a cross-tenant create issuePayload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions… | Fix |
| CVE-2026-105864 | 6 Oct 2026 | CVSS 4.3 | @payloadcms/plugin-multi-tenant has a cross-tenant create issuePayload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions… | Fix |
| CVE-2026-105865 | 6 Oct 2026 | CVSS 8.1 | Payload: Incomplete validation during the upload file lifecyclePayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an… | Fix |
| CVE-2026-105866 | 6 Oct 2026 | CVSS 7.5 | Payload: Unauthenticated account-lockout denial of servicePayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an… | Fix |
| CVE-2026-105853 | 6 Oct 2026 | CVSS 6.5 | Payload: Token refresh and password reset responses may expose restricted user fieldsPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105854 | 6 Oct 2026 | CVSS 7.5 | Payload: ReDoS in Multipart Content-Type ValidationPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105855 | 6 Oct 2026 | CVSS 7.1 | Payload didn't enforce field-level password update restrictionsPayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the… | Fix |
| CVE-2026-105856 | 6 Oct 2026 | CVSS 8.3 | Payload: SQL injection in SQLite/PostgresPayload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update… | Fix |
| CVE-2026-105856 | 6 Oct 2026 | CVSS 8.3 | Payload: SQL injection in SQLite/PostgresPayload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update… | Fix |
| CVE-2026-105857 | 6 Oct 2026 | CVSS 10.0 | Payload Form Builder has an RCE issuePayload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions… | Fix |
| CVE-2026-105858 | 6 Oct 2026 | CVSS 8.1 | Payload: Remote Code Execution through first-registerPayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted… | Fix |
| CVE-2026-105859 | 6 Oct 2026 | CVSS 9.8 | Payload: Unauthorized update to collection documentsPayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an… | Fix |
| CVE-2026-105847 | 6 Oct 2026 | CVSS 6.5 | Payload: Polymorphic join queries could disclose hidden fieldsPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105848 | 6 Oct 2026 | CVSS 9.6 | Payload: Insufficient Access Control in Stripe REST ProxyPayload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105848 | 6 Oct 2026 | CVSS 9.6 | Payload: Insufficient Access Control in Stripe REST ProxyPayload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105849 | 6 Oct 2026 | CVSS 8.3 | Payload vulnerable to API key disclosure through ordinary document readsPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105850 | 6 Oct 2026 | CVSS 8.2 | Payload Ecommerce has an order confirmation validation issuePayload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions… | Fix |
| CVE-2026-105850 | 6 Oct 2026 | CVSS 8.2 | Payload Ecommerce has an order confirmation validation issuePayload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions… | Fix |
| CVE-2026-105851 | 6 Oct 2026 | CVSS 8.1 | Payload: Field access control bypass on auth collectionsPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before… | Fix |
| CVE-2026-105852 | 6 Oct 2026 | CVSS 7.5 | Payload relationship-query authorization bypassPayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying… | Fix |
| CVE-2026-105846 | 6 Oct 2026 | CVSS 6.1 | Payload: Untrusted redirect URL parameter exploitPayload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before… | Fix |
| CVE-2026-105846 | 6 Oct 2026 | CVSS 6.1 | Payload: Untrusted redirect URL parameter exploitPayload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before… | Fix |
| CVE-2026-105805 | 6 Oct 2026 | CVSS 6.9 | Payload: Sort queries could expose protected field informationPayload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an… | Fix |
| CVE-2026-105806 | 6 Oct 2026 | CVSS 8.6 | Payload: Improper access control for MCP API keysPayload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated… | Fix |
| CVE-2026-105806 | 6 Oct 2026 | CVSS 8.6 | Payload: Improper access control for MCP API keysPayload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated… | Fix |
| CVE-2026-105844 | 6 Oct 2026 | CVSS 9.3 | Payload: Prototype pollution in Payload Import Export pluginPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before… | Fix |
| CVE-2026-105844 | 6 Oct 2026 | CVSS 9.3 | Payload: Prototype pollution in Payload Import Export pluginPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before… | Fix |
| CVE-2026-105845 | 6 Oct 2026 | CVSS 9.8 | Payload: SQL Injection in SQLite and PostgresPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before… | Fix |
| CVE-2026-105804 | 6 Oct 2026 | CVSS 5.7 | Payload: Password hashes use insufficient PBKDF2 iterationsPayload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from… | Fix |
| CVE-2026-93363 | 25 Sep 2026 | CVSS 4.3 | payloadcms payloadThe @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to… |