@payloadcms

Products

Exploited and recent CVEs

• CVE-2026-106100 High 7.1 Payload: Field-level write access bypass in Payload on MongoDB 0.2%
• CVE-2026-105868 High 8.6 Payload: Uploaded XML files could execute same-origin JavaScript 0.2%
• CVE-2026-105867 High 7.1 Payload: Client uploads could overwrite S3 objects 0.2%
• CVE-2026-105867 High 7.1 Payload: Client uploads could overwrite S3 objects 0.2%
• CVE-2026-105866 Medium 6.9 Payload: Unauthenticated account-lockout denial of service 0.4%
• CVE-2026-105865 High 8.1 Payload: Incomplete validation during the upload file lifecycle 0.4%
• CVE-2026-105864 Medium 5.3 Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant 0.2%
• CVE-2026-105864 Medium 5.3 Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant 0.2%
• CVE-2026-105863 Critical 9.2 Payload authentication token field handling issue 0.4%
• CVE-2026-105862 High 8.7 Payload: Bypassed sanitization of user uploaded SVGs 0.3%
• CVE-2026-105861 High 7.2 Payload external upload trust validation issue 0.1%
• CVE-2026-105860 High 7.1 Payload: Tenant authorization bypass in Multi-Tenant Plugin 0.2%
• CVE-2026-105859 Critical 9.8 Payload: Unauthorized update to collection documents 0.3%
• CVE-2026-105858 High 8.1 Payload: Remote Code Execution through first-register 0.5%
• CVE-2026-105857 Critical 10.0 Payload: RCE in Payload Form Builder 0.4%
• CVE-2026-105856 High 8.6 Payload: SQL injection in SQLite/Postgres 0.3%
• CVE-2026-105856 High 8.6 Payload: SQL injection in SQLite/Postgres 0.3%
• CVE-2026-105856 High 8.6 Payload: SQL injection in SQLite/Postgres 0.3%
• CVE-2026-105856 High 8.6 Payload: SQL injection in SQLite/Postgres 0.3%
• CVE-2026-105856 High 8.6 Payload: SQL injection in SQLite/Postgres 0.3%
• CVE-2026-105855 High 7.6 Payload: Field-level password update restrictions were not enforced 0.2%
• CVE-2026-105854 High 8.7 Payload: ReDoS in Multipart Content-Type Validation 0.4%
• CVE-2026-105853 High 7.1 Payload: Token refresh and password reset responses may expose restricted user fields 0.3%
• CVE-2026-105852 Medium 6.9 Payload relationship-query authorization bypass 0.3%
• CVE-2026-105851 Critical 9.3 Payload: Field access control bypass on auth collections 0.2%
• CVE-2026-105850 High 8.8 Payload: Order confirmation validation issue in Payload Ecommerce 0.3%
• CVE-2026-105850 High 8.8 Payload: Order confirmation validation issue in Payload Ecommerce 0.3%
• CVE-2026-105849 High 7.7 Payload: API key disclosure through ordinary document reads 0.3%
• CVE-2026-105848 Medium 6.4 Payload: Insufficient Access Control in Stripe REST Proxy 0.2%
• CVE-2026-105848 Medium 6.4 Payload: Insufficient Access Control in Stripe REST Proxy 0.2%