# cve.now: Payloadcms

The newest entries naming Payloadcms as an affected vendor (up to 200), of 41 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-106100](https://cve.now/CVE-2026-106100.md): Payload: Field-level write access bypass in Payload on MongoDB (CVSS 7.1)
- [CVE-2026-105868](https://cve.now/CVE-2026-105868.md): Payload: Uploaded XML files could execute same-origin JavaScript (CVSS 8.6)
- [CVE-2026-105867](https://cve.now/CVE-2026-105867.md): Payload: Client uploads could overwrite S3 objects (CVSS 7.1)
- [CVE-2026-105866](https://cve.now/CVE-2026-105866.md): Payload: Unauthenticated account-lockout denial of service (CVSS 6.9)
- [CVE-2026-105865](https://cve.now/CVE-2026-105865.md): Payload: Incomplete validation during the upload file lifecycle (CVSS 8.1)
- [CVE-2026-105864](https://cve.now/CVE-2026-105864.md): Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant (CVSS 5.3)
- [CVE-2026-105863](https://cve.now/CVE-2026-105863.md): Payload authentication token field handling issue (CVSS 9.2)
- [CVE-2026-105862](https://cve.now/CVE-2026-105862.md): Payload: Bypassed sanitization of user uploaded SVGs (CVSS 8.7)
- [CVE-2026-105861](https://cve.now/CVE-2026-105861.md): Payload external upload trust validation issue (CVSS 7.2)
- [CVE-2026-105860](https://cve.now/CVE-2026-105860.md): Payload: Tenant authorization bypass in Multi-Tenant Plugin (CVSS 7.1)
- [CVE-2026-105859](https://cve.now/CVE-2026-105859.md): Payload: Unauthorized update to collection documents (CVSS 9.8)
- [CVE-2026-105858](https://cve.now/CVE-2026-105858.md): Payload: Remote Code Execution through first-register (CVSS 8.1)
- [CVE-2026-105857](https://cve.now/CVE-2026-105857.md): Payload: RCE in Payload Form Builder (CVSS 10.0)
- [CVE-2026-105856](https://cve.now/CVE-2026-105856.md): Payload: SQL injection in SQLite/Postgres (CVSS 8.6)
- [CVE-2026-105855](https://cve.now/CVE-2026-105855.md): Payload: Field-level password update restrictions were not enforced (CVSS 7.6)
- [CVE-2026-105854](https://cve.now/CVE-2026-105854.md): Payload: ReDoS in Multipart Content-Type Validation (CVSS 8.7)
- [CVE-2026-105853](https://cve.now/CVE-2026-105853.md): Payload: Token refresh and password reset responses may expose restricted user fields (CVSS 7.1)
- [CVE-2026-105852](https://cve.now/CVE-2026-105852.md): Payload relationship-query authorization bypass (CVSS 6.9)
- [CVE-2026-105851](https://cve.now/CVE-2026-105851.md): Payload: Field access control bypass on auth collections (CVSS 9.3)
- [CVE-2026-105850](https://cve.now/CVE-2026-105850.md): Payload: Order confirmation validation issue in Payload Ecommerce (CVSS 8.8)
- [CVE-2026-105849](https://cve.now/CVE-2026-105849.md): Payload: API key disclosure through ordinary document reads (CVSS 7.7)
- [CVE-2026-105848](https://cve.now/CVE-2026-105848.md): Payload: Insufficient Access Control in Stripe REST Proxy (CVSS 6.4)
- [CVE-2026-105847](https://cve.now/CVE-2026-105847.md): Payload: Polymorphic join queries could disclose hidden fields (CVSS 7.1)
- [CVE-2026-105846](https://cve.now/CVE-2026-105846.md): Payload: Untrusted redirect URL parameter exploit (CVSS 6.1)
- [CVE-2026-105845](https://cve.now/CVE-2026-105845.md): Payload: SQL Injection in SQLite and Postgres (CVSS 9.8)
- [CVE-2026-105844](https://cve.now/CVE-2026-105844.md): Payload: Prototype pollution in Payload Import Export plugin (CVSS 9.3)
- [CVE-2026-105806](https://cve.now/CVE-2026-105806.md): Payload: Improper access control for MCP API keys (CVSS 8.6)
- [CVE-2026-105805](https://cve.now/CVE-2026-105805.md): Payload: Sort queries could expose protected field information (CVSS 6.9)
- [CVE-2026-105804](https://cve.now/CVE-2026-105804.md): Payload: Password hashes use insufficient PBKDF2 iterations (CVSS 5.7)
- [CVE-2026-93363](https://cve.now/CVE-2026-93363.md): Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route (CVSS 5.3)
- [CVE-2026-11779](https://cve.now/CVE-2026-11779.md): PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access (CVSS 5.3)
- [CVE-2026-34750](https://cve.now/CVE-2026-34750.md): Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints (CVSS 6.5)
- [CVE-2026-34749](https://cve.now/CVE-2026-34749.md): Payload has a CSRF Protection Bypass in Authentication Flow (CVSS 5.4)
- [CVE-2026-34748](https://cve.now/CVE-2026-34748.md): @payloadcms/next has Stored XSS in Admin Panel (CVSS 8.7)
- [CVE-2026-34747](https://cve.now/CVE-2026-34747.md): Payload has an SQL Injection via Query Handling (CVSS 8.5)
- [CVE-2026-34746](https://cve.now/CVE-2026-34746.md): Payload has Authenticated SSRF via Upload Functionality (CVSS 7.7)
- [CVE-2026-34751](https://cve.now/CVE-2026-34751.md): Payload has Unvalidated Input in Password Recovery Endpoints (CVSS 9.1)
- [CVE-2026-27567](https://cve.now/CVE-2026-27567.md): Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads (CVSS 6.5)
- [CVE-2026-25544](https://cve.now/CVE-2026-25544.md): Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters (CVSS 9.8)
- [CVE-2026-25574](https://cve.now/CVE-2026-25574.md): Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments) (CVSS 5.4)
- [CVE-2023-30843](https://cve.now/CVE-2023-30843.md): Payload's hidden fields can be leaked on readable collections (CVSS 7.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/payloadcms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.