Skip to content
Payloadcms Payload vulnerabilities
-
payloadcms payload
Payload: Field-level write access bypass in Payload on MongoDB
CVE-2026-106100
Fix available
7.1 High
-
payloadcms payload
Payload: Uploaded XML files could execute same-origin JavaScript
CVE-2026-105868
Fix available
8.6 High
-
@payloadcms storage-s3, payloadcms payload +1 more
Payload: Client uploads could overwrite S3 objects
CVE-2026-105867
Fix available
7.1 High
-
payloadcms payload
Payload: Unauthenticated account-lockout denial of service
CVE-2026-105866
Fix available
6.9 Medium
-
payloadcms payload
Payload: Incomplete validation during the upload file lifecycle
CVE-2026-105865
Fix available
8.1 High
-
@payloadcms plugin-multi-tenant, payloadcms payload +1 more
Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant
CVE-2026-105864
Fix available
5.3 Medium
-
payloadcms payload
Payload authentication token field handling issue
CVE-2026-105863
Public exploitFix available
9.2 Critical
-
payloadcms payload
Payload: Bypassed sanitization of user uploaded SVGs
CVE-2026-105862
Fix available
8.7 High
-
payloadcms payload
Payload external upload trust validation issue
CVE-2026-105861
Fix available
7.2 High
-
payloadcms payload
Payload: Tenant authorization bypass in Multi-Tenant Plugin
CVE-2026-105860
Fix available
7.1 High
-
payloadcms payload
Payload: Unauthorized update to collection documents
CVE-2026-105859
Fix available
9.8 Critical
-
payloadcms payload
Payload: Remote Code Execution through first-register
CVE-2026-105858
Fix available
8.1 High
-
payloadcms payload
Payload: RCE in Payload Form Builder
CVE-2026-105857
Fix available
10.0 Critical
-
payloadcms payload, @payloadcms db-d1-sqlite, db-postgres +2 more +4 more
Payload: SQL injection in SQLite/Postgres
CVE-2026-105856
Fix available
8.6 High
-
payloadcms payload
Payload: Field-level password update restrictions were not enforced
CVE-2026-105855
Fix available
7.6 High
-
payloadcms payload
Payload: ReDoS in Multipart Content-Type Validation
CVE-2026-105854
Fix available
8.7 High
-
payloadcms payload
Payload: Token refresh and password reset responses may expose restricted user fields
CVE-2026-105853
Fix available
7.1 High
-
payloadcms payload
Payload relationship-query authorization bypass
CVE-2026-105852
Fix available
6.9 Medium
-
payloadcms payload
Payload: Field access control bypass on auth collections
CVE-2026-105851
Fix available
9.3 Critical
-
@payloadcms plugin-ecommerce, payloadcms payload +1 more
Payload: Order confirmation validation issue in Payload Ecommerce
CVE-2026-105850
Fix available
8.8 High
-
payloadcms payload
Payload: API key disclosure through ordinary document reads
CVE-2026-105849
Fix available
7.7 High
-
@payloadcms plugin-stripe, payloadcms payload +1 more
Payload: Insufficient Access Control in Stripe REST Proxy
CVE-2026-105848
Fix available
6.4 Medium
-
payloadcms payload
Payload: Polymorphic join queries could disclose hidden fields
CVE-2026-105847
Fix available
7.1 High
-
payloadcms payload, @payloadcms next +1 more
Payload: Untrusted redirect URL parameter exploit
CVE-2026-105846
Fix available
6.1 Medium
-
payloadcms payload
Payload: SQL Injection in SQLite and Postgres
CVE-2026-105845
Fix available
9.8 Critical
-
@payloadcms plugin-import-export, payloadcms payload +1 more
Payload: Prototype pollution in Payload Import Export plugin
CVE-2026-105844
Public exploitFix available
9.3 Critical
-
@payloadcms plugin-mcp, payloadcms payload +1 more
Payload: Improper access control for MCP API keys
CVE-2026-105806
Fix available
8.6 High
-
payloadcms payload
Payload: Sort queries could expose protected field information
CVE-2026-105805
Fix available
6.9 Medium
-
payloadcms payload
Payload: Password hashes use insufficient PBKDF2 iterations
CVE-2026-105804
Fix available
5.7 Medium
-
payloadcms payload
Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route
CVE-2026-93363
Fix available
5.3 Medium
-
payloadcms
PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access
CVE-2026-11779
5.3 Medium
-
payloadcms payload
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
CVE-2026-34750
Fix available
6.5 Medium
-
payloadcms payload
Payload has a CSRF Protection Bypass in Authentication Flow
CVE-2026-34749
Fix available
5.4 Medium
-
payloadcms payload
@payloadcms/next has Stored XSS in Admin Panel
CVE-2026-34748
Fix available
8.7 High
-
payloadcms payload
Payload has an SQL Injection via Query Handling
CVE-2026-34747
Fix available
8.5 High
-
payloadcms payload
Payload has Authenticated SSRF via Upload Functionality
CVE-2026-34746
Fix available
7.7 High
-
payloadcms payload
Payload has Unvalidated Input in Password Recovery Endpoints
CVE-2026-34751
Fix available
9.1 Critical
-
payloadcms payload
Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads
CVE-2026-27567
Fix available
6.5 Medium
-
payloadcms payload
Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)
CVE-2026-25574
Fix available
5.4 Medium
-
payloadcms payload
Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
CVE-2026-25544
Public exploitFix available
9.8 Critical
-
payload cms payload
User Session Fixation after Account Removal in PayloadCMS
CVE-2025-4644
Fix available
5.3 Medium
-
payload cms payload
Lack of JWT Expiration after Log Out in PayloadCMS
CVE-2025-4643
Fix available
6.3 Medium
-
payloadcms payload
Payload's hidden fields can be leaked on readable collections
CVE-2023-30843
Fix available
7.4 High
-
payloadcms payload
Unrestricted Upload of File with Dangerous Type in Payload
CVE-2022-27952
Fix available
9.8 Critical