Login Request a demo
PA
Product
payload
by payloadcms · last CVE Oct 6, 2026
41
CVEs
0
On KEV
10.0
Max CVSS
29
New 30D
Vulnerabilities41In the news0Timeline
Severity mix
Critical 9High 19Medium 13Low 0
Severity
All severities41Critical9High19Medium13Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add payload to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-105805
6.9
0%
Oct 6
Payload: Sort queries could expose protected field information
Affected: < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27
CVE-2026-105867
6.5
0%
Oct 6
Payload: Client uploads could overwrite S3 objects
Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
CVE-2026-105853
6.5
0%
Oct 6
Payload: Token refresh and password reset responses may expose restricted user fields
Affected: >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
CVE-2026-105847
6.5
0%
Oct 6
Payload: Polymorphic join queries could disclose hidden fields
Affected: >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
CVE-2026-34750
6.5
0%
Apr 1
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
Affected: < 3.78.0
CVE-2023-30843
6.5
1%
Apr 26
Payload is a free and open source headless content management system
Affected: before 1.7.0
CVE-2026-105846
6.1
0%
Oct 6
Payload: Untrusted redirect URL parameter exploit
Affected: >= 3.40.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27
CVE-2026-105804
5.7
0%
Oct 6
Payload: Password hashes use insufficient PBKDF2 iterations
Affected: >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
CVE-2026-34749
5.4
0%
Apr 1
Payload has a CSRF Protection Bypass in Authentication Flow
Affected: < 3.79.1
CVE-2026-25574
5.4
0%
Feb 6
Payload is a free and open source headless content management system
Affected: before 3.74.0
CVE-2026-27567
4.8
0%
Feb 24
Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads
Affected: < 3.75.0
CVE-2026-105864
4.3
0%
Oct 6
Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant
Affected: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
CVE-2026-93363
4.3
0%
Sep 25
Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route
Affected: 3.25.0 before 3.90.0; 4.0.0-canary.0 before 4.0.0-canary.34
Showing 13