@payloadcms payload

• CVE-2026-106100 High 7.1 Payload: Field-level write access bypass in Payload on MongoDB 0.2%
• CVE-2026-105868 High 8.6 Payload: Uploaded XML files could execute same-origin JavaScript 0.2%
• CVE-2026-105867 High 7.1 Payload: Client uploads could overwrite S3 objects 0.2%
• CVE-2026-105866 Medium 6.9 Payload: Unauthenticated account-lockout denial of service 0.4%
• CVE-2026-105865 High 8.1 Payload: Incomplete validation during the upload file lifecycle 0.4%
• CVE-2026-105864 Medium 5.3 Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant 0.2%
• CVE-2026-105863 Critical 9.2 Payload authentication token field handling issue 0.4%
• CVE-2026-105862 High 8.7 Payload: Bypassed sanitization of user uploaded SVGs 0.3%
• CVE-2026-105861 High 7.2 Payload external upload trust validation issue 0.1%
• CVE-2026-105860 High 7.1 Payload: Tenant authorization bypass in Multi-Tenant Plugin 0.2%
• CVE-2026-105859 Critical 9.8 Payload: Unauthorized update to collection documents 0.3%
• CVE-2026-105858 High 8.1 Payload: Remote Code Execution through first-register 0.5%
• CVE-2026-105857 Critical 10.0 Payload: RCE in Payload Form Builder 0.4%
• CVE-2026-105856 High 8.6 Payload: SQL injection in SQLite/Postgres 0.3%
• CVE-2026-105855 High 7.6 Payload: Field-level password update restrictions were not enforced 0.2%
• CVE-2026-105854 High 8.7 Payload: ReDoS in Multipart Content-Type Validation 0.4%
• CVE-2026-105853 High 7.1 Payload: Token refresh and password reset responses may expose restricted user fields 0.3%
• CVE-2026-105852 Medium 6.9 Payload relationship-query authorization bypass 0.3%
• CVE-2026-105851 Critical 9.3 Payload: Field access control bypass on auth collections 0.2%
• CVE-2026-105850 High 8.8 Payload: Order confirmation validation issue in Payload Ecommerce 0.3%
• CVE-2026-105849 High 7.7 Payload: API key disclosure through ordinary document reads 0.3%
• CVE-2026-105848 Medium 6.4 Payload: Insufficient Access Control in Stripe REST Proxy 0.2%
• CVE-2026-105847 High 7.1 Payload: Polymorphic join queries could disclose hidden fields 0.2%
• CVE-2026-105846 Medium 6.1 Payload: Untrusted redirect URL parameter exploit 0.2%
• CVE-2026-105845 Critical 9.8 Payload: SQL Injection in SQLite and Postgres 0.4%
• CVE-2026-105844 Critical 9.3 Payload: Prototype pollution in Payload Import Export plugin 0.7%
• CVE-2026-105806 High 8.6 Payload: Improper access control for MCP API keys 0.3%
• CVE-2026-105805 Medium 6.9 Payload: Sort queries could expose protected field information 0.3%
• CVE-2026-105804 Medium 5.7 Payload: Password hashes use insufficient PBKDF2 iterations <0.1%
• CVE-2026-93363 Medium 4.3 Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route 0.2%
• CVE-2026-34750 Medium 6.5 Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints 0.4%
• CVE-2026-34749 Medium 5.4 Payload has a CSRF Protection Bypass in Authentication Flow 0.1%
• CVE-2026-34748 High 8.7 @payloadcms/next has Stored XSS in Admin Panel 0.3%
• CVE-2026-34747 High 8.5 Payload has an SQL Injection via Query Handling 0.3%
• CVE-2026-34746 High 7.7 Payload has Authenticated SSRF via Upload Functionality 0.3%
• CVE-2026-34751 Critical 9.1 Payload has Unvalidated Input in Password Recovery Endpoints 0.3%
• CVE-2026-27567 Medium 6.5 Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads 0.3%
• CVE-2026-25544 Critical 9.8 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters 0.8%
• CVE-2026-25574 Medium 5.4 Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments) 0.2%
• CVE-2023-30843 High 7.4 Payload's hidden fields can be leaked on readable collections 0.6%