Payloadcms vulnerabilities
41 CVEs and advisories name Payloadcms as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-11779PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access
- CVE-2026-34750Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
- CVE-2026-34749Payload has a CSRF Protection Bypass in Authentication Flow
- CVE-2026-34748@payloadcms/next has Stored XSS in Admin Panel
- CVE-2026-34747Payload has an SQL Injection via Query Handling
- CVE-2026-34746Payload has Authenticated SSRF via Upload Functionality
- CVE-2026-34751Payload has Unvalidated Input in Password Recovery Endpoints
- CVE-2026-27567Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads
- CVE-2026-25544Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
- CVE-2026-25574Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)
- CVE-2023-30843Payload's hidden fields can be leaked on readable collections