Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
CVE-2026-93363
  • github.com/payloadcms/payload
 Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route 25 Sep
  • Fix available
  • Severity - 5.3 (Medium)
CVE-2026-11779
  • github.com/payloadcms/payload
 PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access 26 Jun
  • No fix available
  • Severity - 5.3 (Medium)
GHSA-frq9-7j6g-v74x
  • npm/@payloadcms/storage-azure
  • npm/@payloadcms/storage-gcs
  • npm/@payloadcms/storage-r2
  • npm/@payloadcms/storage-s3
 Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints 01 Apr
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-mmxc-95ch-2j7c
  • npm/@payloadcms/next
 @payloadcms/next has Stored XSS in Admin Panel 01 Apr
  • Fix available
  • Severity - 8.7 (High)
CVE-2026-34750
  • github.com/payloadcms/payload
 Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints 01 Apr
  • Fix available
  • Severity - 6.5 (Medium)
CVE-2026-34749
  • github.com/payloadcms/payload
 Payload has a CSRF Protection Bypass in Authentication Flow 01 Apr
  • Fix available
  • Severity - 5.4 (Medium)
CVE-2026-34748
  • github.com/payloadcms/payload
 @payloadcms/next has Stored XSS in Admin Panel 01 Apr
  • Fix available
  • Severity - 8.7 (High)
CVE-2026-34747
  • github.com/payloadcms/payload
 Payload has an SQL Injection via Query Handling 01 Apr
  • Fix available
  • Severity - 8.5 (High)
CVE-2026-34746
  • github.com/payloadcms/payload
 Payload has Authenticated SSRF via Upload Functionality 01 Apr
  • Fix available
  • Severity - 7.7 (High)
CVE-2026-34751
  • github.com/payloadcms/payload
 Payload has Unvalidated Input in Password Recovery Endpoints 01 Apr
  • Fix available
  • Severity - 9.1 (Critical)
GHSA-hp5w-3hxx-vmwf
  • npm/@payloadcms/graphql
  • npm/payload
 Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery 01 Apr
  • Fix available
  • Severity - 9.1 (Critical)
CVE-2026-27567
  • github.com/payloadcms/payload
 Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads 24 Feb
  • Fix available
  • Severity - 6.5 (Medium)
CVE-2026-25544
  • github.com/payloadcms/payload
 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters 06 Feb
  • Fix available
  • Severity - 9.8 (Critical)
CVE-2026-25574
  • github.com/payloadcms/payload
 Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments) 06 Feb
  • Fix available
  • Severity - 5.4 (Medium)
GHSA-xx6w-jxg9-2wh8
  • npm/@payloadcms/drizzle
 @payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters 05 Feb
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-26rv-h2hf-3fw4
  • npm/@payloadcms/graphql
  • npm/@payloadcms/next
  • npm/payload
 Payload's SQLite adapter Session Fixation vulnerability 29 Aug 2025
  • Fix available
  • Severity - 5.3 (Medium)
Load more...