Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
CVE-2026-93363
  • github.com/payloadcms/payload
 Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route 25 Sep
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-4qpv-39hg-f7fx
  • npm/@jhb.software/payload-alt-text-plugin
 @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission 10 Sep
  • Fix available
  • Severity - 7.1 (High)
MAL-2026-14191
  • npm/test_payload_folder
 Malicious code in test_payload_folder (npm) 19 Aug
  • No fix available
GHSA-jg8r-5jh2-v2xj
  • npm/payload
 Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts 26 Jun
  • No fix available
  • Severity - 5.3 (Medium)
CVE-2026-11779
  • github.com/payloadcms/payload
 PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access 26 Jun
  • No fix available
  • Severity - 5.3 (Medium)
GHSA-h5x8-xp6m-x6q4
  • npm/@jhb.software/payload-cloudinary-plugin
 @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing 19 Jun
  • Fix available
  • Severity - 7.1 (High)
MAL-2026-5040
  • npm/@t-in-one/only_difference_payload
 Malicious code in @t-in-one/only_difference_payload (npm) 29 May
  • No fix available
GHSA-65w6-pf7x-5g85
  • npm/@delmaredigital/payload-puck
 @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections 08 Apr
  • Fix available
  • Severity - 9.4 (Critical)
GHSA-p6mr-xf3r-ghq4
  • npm/payload
 Payload has a CSRF Protection Bypass in Authentication Flow 01 Apr
  • Fix available
  • Severity - 5.4 (Medium)
GHSA-6r7f-q7f5-wpx8
  • npm/payload
 Payload has Authenticated SSRF via Upload Functionality 01 Apr
  • Fix available
  • Severity - 7.7 (High)
GHSA-7xxh-373w-35vg
  • npm/payload
 Payload has an SQL Injection via Query Handling 01 Apr
  • Fix available
  • Severity - 8.5 (High)
CVE-2026-34750
  • github.com/payloadcms/payload
 Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints 01 Apr
  • Fix available
  • Severity - 6.5 (Medium)
CVE-2026-34749
  • github.com/payloadcms/payload
 Payload has a CSRF Protection Bypass in Authentication Flow 01 Apr
  • Fix available
  • Severity - 5.4 (Medium)
CVE-2026-34748
  • github.com/payloadcms/payload
 @payloadcms/next has Stored XSS in Admin Panel 01 Apr
  • Fix available
  • Severity - 8.7 (High)
CVE-2026-34747
  • github.com/payloadcms/payload
 Payload has an SQL Injection via Query Handling 01 Apr
  • Fix available
  • Severity - 8.5 (High)
CVE-2026-34746
  • github.com/payloadcms/payload
 Payload has Authenticated SSRF via Upload Functionality 01 Apr
  • Fix available
  • Severity - 7.7 (High)
Load more...