PA
Vendor
payloadcms
53
CVEs
0
On KEV
40
New 30D
Products
PA10.0
payload
payloadcms
41 CVEs0 on KEV29 new
PL9.3
plugin-import-export
@payloadcms
1 CVEs0 on KEV1 new
PL9.6
plugin-stripe
@payloadcms
1 CVEs0 on KEV1 new
DB8.3
db-d1-sqlite
@payloadcms
1 CVEs0 on KEV1 new
DB8.3
db-postgres
@payloadcms
1 CVEs0 on KEV1 new
DB8.3
db-sqlite
@payloadcms
1 CVEs0 on KEV1 new
DB8.3
db-vercel-postgres
@payloadcms
1 CVEs0 on KEV1 new
NE6.1
next
@payloadcms
1 CVEs0 on KEV1 new
PL8.2
plugin-ecommerce
@payloadcms
1 CVEs0 on KEV1 new
PL8.6
plugin-mcp
@payloadcms
1 CVEs0 on KEV1 new
PL4.3
plugin-multi-tenant
@payloadcms
1 CVEs0 on KEV1 new
ST6.5
storage-s3
@payloadcms
1 CVEs0 on KEV1 new
PA5.3
PayloadCMS
PayloadCMS
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-106100 | PA payload payloadcms | 7.1 | Oct 6 | Payload: Field-level write access bypass in Payload on MongoDB |
| CVE-2026-105868 | PA payload payloadcms | 7.1 | Oct 6 | Payload: Uploaded XML files could execute same-origin JavaScript |
| CVE-2026-105867 | PA payload payloadcms | 6.5 | Oct 6 | Payload: Client uploads could overwrite S3 objects |
| CVE-2026-105866 | PA payload payloadcms | 7.5 | Oct 6 | Payload: Unauthenticated account-lockout denial of service |
| CVE-2026-105865 | PA payload payloadcms | 8.1 | Oct 6 | Payload: Incomplete validation during the upload file lifecycle |
| CVE-2026-105864 | PL plugin-multi-tenant @payloadcms | 4.3 | Oct 6 | Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant |
| CVE-2026-105863 | PA payload payloadcms | 9.4 | Oct 6 | Payload authentication token field handling issue |
| CVE-2026-105862 | PA payload payloadcms | 8.7 | Oct 6 | Payload: Bypassed sanitization of user uploaded SVGs |
| CVE-2026-105861 | PA payload payloadcms | 8.2 | Oct 6 | Payload external upload trust validation issue |
| CVE-2026-105860 | PA payload payloadcms | 7.1 | Oct 6 | Payload: Tenant authorization bypass in Multi-Tenant Plugin |
| CVE-2026-105859 | PA payload payloadcms | 9.8 | Oct 6 | Payload: Unauthorized update to collection documents |
| CVE-2026-105858 | PA payload payloadcms | 8.1 | Oct 6 | Payload: Remote Code Execution through first-register |
| CVE-2026-105857 | PA payload payloadcms | 10.0 | Oct 6 | Payload: RCE in Payload Form Builder |
| CVE-2026-105856 | DB db-sqlite @payloadcms | 8.3 | Oct 6 | Payload: SQL injection in SQLite/Postgres |
| CVE-2026-105855 | PA payload payloadcms | 7.1 | Oct 6 | Payload: Field-level password update restrictions were not enforced |
| CVE-2026-105854 | PA payload payloadcms | 7.5 | Oct 6 | Payload: ReDoS in Multipart Content-Type Validation |
| CVE-2026-105853 | PA payload payloadcms | 6.5 | Oct 6 | Payload: Token refresh and password reset responses may expose restricted user fields |
| CVE-2026-105852 | PA payload payloadcms | 7.5 | Oct 6 | Payload relationship-query authorization bypass |
| CVE-2026-105851 | PA payload payloadcms | 8.1 | Oct 6 | Payload: Field access control bypass on auth collections |
| CVE-2026-105850 | PA payload payloadcms | 8.2 | Oct 6 | Payload: Order confirmation validation issue in Payload Ecommerce |
| CVE-2026-105849 | PA payload payloadcms | 8.3 | Oct 6 | Payload: API key disclosure through ordinary document reads |
| CVE-2026-105848 | PA payload payloadcms | 9.6 | Oct 6 | Payload: Insufficient Access Control in Stripe REST Proxy |
| CVE-2026-105847 | PA payload payloadcms | 6.5 | Oct 6 | Payload: Polymorphic join queries could disclose hidden fields |
| CVE-2026-105846 | NE next @payloadcms | 6.1 | Oct 6 | Payload: Untrusted redirect URL parameter exploit |
| CVE-2026-105845 | PA payload payloadcms | 9.8 | Oct 6 | Payload: SQL Injection in SQLite and Postgres |
| CVE-2026-105844 | PA payload payloadcms | 9.3 | Oct 6 | Payload: Prototype pollution in Payload Import Export plugin |
| CVE-2026-105806 | PL plugin-mcp @payloadcms | 8.6 | Oct 6 | Payload: Improper access control for MCP API keys |
| CVE-2026-105805 | PA payload payloadcms | 6.9 | Oct 6 | Payload: Sort queries could expose protected field information |
| CVE-2026-105804 | PA payload payloadcms | 5.7 | Oct 6 | Payload: Password hashes use insufficient PBKDF2 iterations |
| CVE-2026-93363 | PA payload payloadcms | 4.3 | Sep 25 | Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route |
| CVE-2026-11779 | PA PayloadCMS PayloadCMS | 5.3 | Jun 26 | PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access |
| CVE-2026-34750 | PA Payload Payloadcms | 6.5 | Apr 1 | Payload is a free and open source headless content management system |
| CVE-2026-34749 | PA Payload Payloadcms | 5.4 | Apr 1 | Payload is a free and open source headless content management system |
| CVE-2026-34748 | PA Payload Payloadcms | 8.7 | Apr 1 | Payload is a free and open source headless content management system |
| CVE-2026-34747 | PA Payload Payloadcms | 8.2 | Apr 1 | Payload is a free and open source headless content management system |
| CVE-2026-34746 | PA Payload Payloadcms | 7.7 | Apr 1 | Payload is a free and open source headless content management system |
| CVE-2026-34751 | PA Payload Payloadcms | 9.1 | Apr 1 | Payload is a free and open source headless content management system |
| CVE-2026-27567 | PA Payload Payloadcms | 4.8 | Feb 24 | Payload is a free and open source headless content management system |
| CVE-2026-25574 | PA Payload Payloadcms | 5.4 | Feb 6 | Payload is a free and open source headless content management system |
| CVE-2026-25544 | PA Payload Payloadcms | 9.8 | Feb 6 | Payload is a free and open source headless content management system |
| CVE-2023-30843 | PA Payload Payloadcms | 6.5 | Apr 26 | Payload is a free and open source headless content management system |
| CVE-2022-27952 | PA Payload Payloadcms | 9.8 | Apr 12 | An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file |