@payloadcms vulnerabilities

Newest

• @payloadcms storage-s3, payloadcms payload +1 more Payload: Client uploads could overwrite S3 objects CVE-2026-105867 Fix available 7.1 HighOctober 6, 2026
• @payloadcms plugin-multi-tenant, payloadcms payload +1 more Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant CVE-2026-105864 Fix available 5.3 MediumOctober 6, 2026
• payloadcms payload, @payloadcms db-d1-sqlite, db-postgres +2 more +4 more Payload: SQL injection in SQLite/Postgres CVE-2026-105856 Fix available 8.6 HighOctober 6, 2026
• @payloadcms plugin-ecommerce, payloadcms payload +1 more Payload: Order confirmation validation issue in Payload Ecommerce CVE-2026-105850 Fix available 8.8 HighOctober 6, 2026
• @payloadcms plugin-stripe, payloadcms payload +1 more Payload: Insufficient Access Control in Stripe REST Proxy CVE-2026-105848 Fix available 6.4 MediumOctober 6, 2026
• payloadcms payload, @payloadcms next +1 more Payload: Untrusted redirect URL parameter exploit CVE-2026-105846 Fix available 6.1 MediumOctober 6, 2026
• @payloadcms plugin-import-export, payloadcms payload +1 more Payload: Prototype pollution in Payload Import Export plugin CVE-2026-105844 Public exploitFix available 9.3 CriticalOctober 6, 2026
• @payloadcms plugin-mcp, payloadcms payload +1 more Payload: Improper access control for MCP API keys CVE-2026-105806 Fix available 8.6 HighOctober 6, 2026