Login Request a demo
PA
Product
payload
by payloadcms · last CVE Oct 6, 2026
41
CVEs
0
On KEV
10.0
Max CVSS
29
New 30D
Vulnerabilities41In the news0Timeline
Severity mix
Critical 9High 19Medium 13Low 0
Severity
All severities41Critical9High19Medium13Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add payload to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-105857
10.0
0%
Oct 6
Payload: RCE in Payload Form Builder
Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
CVE-2026-105859
9.8
0%
Oct 6
Payload: Unauthorized update to collection documents
Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
CVE-2026-105845
9.8
0%
Oct 6
Payload: SQL Injection in SQLite and Postgres
Affected: >= 3.0.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27
CVE-2026-25544
9.8
1%
Feb 6
Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
Affected: < 3.73.0
CVE-2022-27952
9.8
2%
Apr 12
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file
Affected: 0.15.0
CVE-2026-105848
9.6
0%
Oct 6
Payload: Insufficient Access Control in Stripe REST Proxy
Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
CVE-2026-105863
9.4
0%
Oct 6
Payload authentication token field handling issue
Affected: >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
CVE-2026-105844
9.3
1%
Oct 6
Payload: Prototype pollution in Payload Import Export plugin
Affected: >= 3.0.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27
CVE-2026-34751
9.1
0%
Apr 1
Payload has Unvalidated Input in Password Recovery Endpoints
Affected: < 3.79.1
Showing 9