Skip to content

Delmaredigital Payload-puck vulnerabilities

delmaredigital payload-puck@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collectionsCVE-2026-39397Fix available9.4 CriticalApril 7, 2026