PA
Product
payload
41
CVEs
0
On KEV
10.0
Max CVSS
29
New 30D
Severity mix
Critical 9High 19Medium 13Low 0
Watch
Add payload to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-105857 | 10.0 | Oct 6 | Payload: RCE in Payload Form Builder Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105859 | 9.8 | Oct 6 | Payload: Unauthorized update to collection documents Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105845 | 9.8 | Oct 6 | Payload: SQL Injection in SQLite and Postgres Affected: >= 3.0.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27 |
| CVE-2026-25544 | 9.8 | Feb 6 | Payload is a free and open source headless content management system Affected: before 3.73.0 |
| CVE-2022-27952 | 9.8 | Apr 12 | An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file Affected: 0.15.0 |
| CVE-2026-105848 | 9.6 | Oct 6 | Payload: Insufficient Access Control in Stripe REST Proxy Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105863 | 9.4 | Oct 6 | Payload authentication token field handling issue Affected: >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105844 | 9.3 | Oct 6 | Payload: Prototype pollution in Payload Import Export plugin Affected: >= 3.0.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27 |
| CVE-2026-34751 | 9.1 | Apr 1 | Payload has Unvalidated Input in Password Recovery Endpoints Affected: < 3.79.1 |
| CVE-2026-105862 | 8.7 | Oct 6 | Payload: Bypassed sanitization of user uploaded SVGs Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-34748 | 8.7 | Apr 1 | @payloadcms/next has Stored XSS in Admin Panel Affected: < 3.78.0 |
| CVE-2026-105806 | 8.6 | Oct 6 | Payload: Improper access control for MCP API keys Affected: >= 3.61.0, < 3.88.0 |
| CVE-2026-105856 | 8.3 | Oct 6 | Payload: SQL injection in SQLite/Postgres Affected: >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105849 | 8.3 | Oct 6 | Payload: API key disclosure through ordinary document reads Affected: >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105861 | 8.2 | Oct 6 | Payload external upload trust validation issue Affected: > 3.0.0, < 3.90.0; > 4.0.0-canary.0, < 4.0.0-canary-34 |
| CVE-2026-105850 | 8.2 | Oct 6 | Payload: Order confirmation validation issue in Payload Ecommerce Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-34747 | 8.2 | Apr 1 | Payload has an SQL Injection via Query Handling Affected: < 3.79.1 |
| CVE-2026-105865 | 8.1 | Oct 6 | Payload: Incomplete validation during the upload file lifecycle Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105858 | 8.1 | Oct 6 | Payload: Remote Code Execution through first-register Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105851 | 8.1 | Oct 6 | Payload: Field access control bypass on auth collections Affected: > 3.0.0, < 3.90.0; > 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-34746 | 7.7 | Apr 1 | Payload has Authenticated SSRF via Upload Functionality Affected: < 3.79.1 |
| CVE-2026-105866 | 7.5 | Oct 6 | Payload: Unauthenticated account-lockout denial of service Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105854 | 7.5 | Oct 6 | Payload: ReDoS in Multipart Content-Type Validation Affected: >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105852 | 7.5 | Oct 6 | Payload relationship-query authorization bypass Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-106100 | 7.1 | Oct 6 | Payload: Field-level write access bypass in Payload on MongoDB Affected: < 3.87.0; >= 4.0.0-canary.0, < 4.0.0-canary.20 |
| CVE-2026-105868 | 7.1 | Oct 6 | Payload: Uploaded XML files could execute same-origin JavaScript Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105860 | 7.1 | Oct 6 | Payload: Tenant authorization bypass in Multi-Tenant Plugin Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105855 | 7.1 | Oct 6 | Payload: Field-level password update restrictions were not enforced Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105805 | 6.9 | Oct 6 | Payload: Sort queries could expose protected field information Affected: < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27 |
| CVE-2026-105867 | 6.5 | Oct 6 | Payload: Client uploads could overwrite S3 objects Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105853 | 6.5 | Oct 6 | Payload: Token refresh and password reset responses may expose restricted user fields Affected: >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105847 | 6.5 | Oct 6 | Payload: Polymorphic join queries could disclose hidden fields Affected: >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-34750 | 6.5 | Apr 1 | Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints Affected: < 3.78.0 |
| CVE-2023-30843 | 6.5 | Apr 26 | Payload is a free and open source headless content management system Affected: before 1.7.0 |
| CVE-2026-105846 | 6.1 | Oct 6 | Payload: Untrusted redirect URL parameter exploit Affected: >= 3.40.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27 |
| CVE-2026-105804 | 5.7 | Oct 6 | Payload: Password hashes use insufficient PBKDF2 iterations Affected: >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-34749 | 5.4 | Apr 1 | Payload has a CSRF Protection Bypass in Authentication Flow Affected: < 3.79.1 |
| CVE-2026-25574 | 5.4 | Feb 6 | Payload is a free and open source headless content management system Affected: before 3.74.0 |
| CVE-2026-27567 | 4.8 | Feb 24 | Payload is a free and open source headless content management system Affected: before 3.75.0 |
| CVE-2026-105864 | 4.3 | Oct 6 | Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-93363 | 4.3 | Sep 25 | Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route Affected: 3.25.0 before 3.90.0; 4.0.0-canary.0 before 4.0.0-canary.34 |
Showing 41