Payloadcms vulnerabilities
41 CVEs and advisories name Payloadcms as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-106100Payload: Field-level write access bypass in Payload on MongoDB
- CVE-2026-105868Payload: Uploaded XML files could execute same-origin JavaScript
- CVE-2026-105867Payload: Client uploads could overwrite S3 objects
- CVE-2026-105866Payload: Unauthenticated account-lockout denial of service
- CVE-2026-105865Payload: Incomplete validation during the upload file lifecycle
- CVE-2026-105864Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant
- CVE-2026-105863Payload authentication token field handling issue
- CVE-2026-105862Payload: Bypassed sanitization of user uploaded SVGs
- CVE-2026-105861Payload external upload trust validation issue
- CVE-2026-105860Payload: Tenant authorization bypass in Multi-Tenant Plugin
- CVE-2026-105859Payload: Unauthorized update to collection documents
- CVE-2026-105858Payload: Remote Code Execution through first-register
- CVE-2026-105857Payload: RCE in Payload Form Builder
- CVE-2026-105856Payload: SQL injection in SQLite/Postgres
- CVE-2026-105855Payload: Field-level password update restrictions were not enforced
- CVE-2026-105854Payload: ReDoS in Multipart Content-Type Validation
- CVE-2026-105853Payload: Token refresh and password reset responses may expose restricted user fields
- CVE-2026-105852Payload relationship-query authorization bypass
- CVE-2026-105851Payload: Field access control bypass on auth collections
- CVE-2026-105850Payload: Order confirmation validation issue in Payload Ecommerce
- CVE-2026-105849Payload: API key disclosure through ordinary document reads
- CVE-2026-105848Payload: Insufficient Access Control in Stripe REST Proxy
- CVE-2026-105847Payload: Polymorphic join queries could disclose hidden fields
- CVE-2026-105846Payload: Untrusted redirect URL parameter exploit
- CVE-2026-105845Payload: SQL Injection in SQLite and Postgres
- CVE-2026-105844Payload: Prototype pollution in Payload Import Export plugin
- CVE-2026-105806Payload: Improper access control for MCP API keys
- CVE-2026-105805Payload: Sort queries could expose protected field information
- CVE-2026-105804Payload: Password hashes use insufficient PBKDF2 iterations
- CVE-2026-93363Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route