PA
Product
payload
41
CVEs
0
On KEV
10.0
Max CVSS
29
New 30D
Severity mix
Critical 9High 19Medium 13Low 0
Watch
Add payload to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-105862 | 8.7 | Oct 6 | Payload: Bypassed sanitization of user uploaded SVGs Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-34748 | 8.7 | Apr 1 | @payloadcms/next has Stored XSS in Admin Panel Affected: < 3.78.0 |
| CVE-2026-105806 | 8.6 | Oct 6 | Payload: Improper access control for MCP API keys Affected: >= 3.61.0, < 3.88.0 |
| CVE-2026-105856 | 8.3 | Oct 6 | Payload: SQL injection in SQLite/Postgres Affected: >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105849 | 8.3 | Oct 6 | Payload: API key disclosure through ordinary document reads Affected: >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105861 | 8.2 | Oct 6 | Payload external upload trust validation issue Affected: > 3.0.0, < 3.90.0; > 4.0.0-canary.0, < 4.0.0-canary-34 |
| CVE-2026-105850 | 8.2 | Oct 6 | Payload: Order confirmation validation issue in Payload Ecommerce Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-34747 | 8.2 | Apr 1 | Payload has an SQL Injection via Query Handling Affected: < 3.79.1 |
| CVE-2026-105865 | 8.1 | Oct 6 | Payload: Incomplete validation during the upload file lifecycle Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105858 | 8.1 | Oct 6 | Payload: Remote Code Execution through first-register Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105851 | 8.1 | Oct 6 | Payload: Field access control bypass on auth collections Affected: > 3.0.0, < 3.90.0; > 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-34746 | 7.7 | Apr 1 | Payload has Authenticated SSRF via Upload Functionality Affected: < 3.79.1 |
| CVE-2026-105866 | 7.5 | Oct 6 | Payload: Unauthenticated account-lockout denial of service Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105854 | 7.5 | Oct 6 | Payload: ReDoS in Multipart Content-Type Validation Affected: >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105852 | 7.5 | Oct 6 | Payload relationship-query authorization bypass Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-106100 | 7.1 | Oct 6 | Payload: Field-level write access bypass in Payload on MongoDB Affected: < 3.87.0; >= 4.0.0-canary.0, < 4.0.0-canary.20 |
| CVE-2026-105868 | 7.1 | Oct 6 | Payload: Uploaded XML files could execute same-origin JavaScript Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105860 | 7.1 | Oct 6 | Payload: Tenant authorization bypass in Multi-Tenant Plugin Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
| CVE-2026-105855 | 7.1 | Oct 6 | Payload: Field-level password update restrictions were not enforced Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
Showing 19