Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
CVE-2026-63316
  • github.com/payloadcms/payload
 SQL Injection in Payload CMS 13 Oct
  • Fix available
  • Severity - 8.7 (High)
GHSA-97rh-rhh2-7vjv
  • npm/payload
 Payload: Remote Code Execution through first-register 07 Oct
  • Fix available
  • Severity - 8.1 (High)
GHSA-pj5h-5q6c-3pfx
  • npm/payload
 Payload external upload trust validation issue 07 Oct
  • Fix available
  • Severity - 7.2 (High)
GHSA-2pwp-2369-8fg3
  • npm/payload
 Payload: Bypassed sanitization of user uploaded SVGs 07 Oct
  • Fix available
  • Severity - 8.7 (High)
GHSA-p223-2wr2-j562
  • npm/payload
 Payload: Incomplete validation during the upload file lifecycle 07 Oct
  • Fix available
  • Severity - 8.1 (High)
GHSA-v5gf-vpjc-pc7w
  • npm/payload
 Payload: Unauthenticated account-lockout denial of service 07 Oct
  • Fix available
  • Severity - 6.9 (Medium)
GHSA-9qpg-3cf8-w33x
  • npm/payload
 Payload: Uploaded XML files could execute same-origin JavaScript 07 Oct
  • Fix available
  • Severity - 8.6 (High)
GHSA-f7hx-52q9-hcrf
  • npm/payload
 Payload: Unauthorized update to collection documents 07 Oct
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-66wr-7vmr-p5jq
  • npm/payload
 Payload authentication token field handling issue 07 Oct
  • Fix available
  • Severity - 9.2 (Critical)
CVE-2026-106100
  • github.com/payloadcms/payload
 Payload: Field-level write access bypass in Payload on MongoDB 06 Oct
  • Fix available
  • Severity - 7.1 (High)
CVE-2026-105868
  • github.com/payloadcms/payload
 Payload: Uploaded XML files could execute same-origin JavaScript 06 Oct
  • Fix available
  • Severity - 8.6 (High)
CVE-2026-105867
  • github.com/payloadcms/payload
 Payload: Client uploads could overwrite S3 objects 06 Oct
  • Fix available
  • Severity - 7.1 (High)
CVE-2026-105866
  • github.com/payloadcms/payload
 Payload: Unauthenticated account-lockout denial of service 06 Oct
  • Fix available
  • Severity - 6.9 (Medium)
CVE-2026-105865
  • github.com/payloadcms/payload
 Payload: Incomplete validation during the upload file lifecycle 06 Oct
  • Fix available
  • Severity - 8.1 (High)
CVE-2026-105864
  • github.com/payloadcms/payload
 Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant 06 Oct
  • Fix available
  • Severity - 5.3 (Medium)
CVE-2026-105863
  • github.com/payloadcms/payload
 Payload authentication token field handling issue 06 Oct
  • Fix available
  • Severity - 9.2 (Critical)
Load more...