payloadcms payload
40 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-106100 | < 3.87.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.20 | Payload: Field-level write access bypass in Payload on MongoDB | HIGH 7.1 | 0.2 % | ||
| CVE-2026-105868 | < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Uploaded XML files could execute same-origin JavaScript | HIGH 8.6 | 0.2 % | ||
| CVE-2026-105867 | < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Client uploads could overwrite S3 objects | HIGH 7.1 | 0.2 % | ||
| CVE-2026-105866 | < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Unauthenticated account-lockout denial of service | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-105865 | < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Incomplete validation during the upload file lifecycle | HIGH 8.1 | 0.4 % | ||
| CVE-2026-105864 | < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-105863 | >= 3.0.0, < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload authentication token field handling issue | CRITICAL 9.2 | 0.4 % | ||
| CVE-2026-105862 | < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Bypassed sanitization of user uploaded SVGs | HIGH 8.7 | 0.3 % | ||
| CVE-2026-105861 | > 3.0.0, < 3.90.0 ; > 4.0.0-canary.0, < 4.0.0-canary-34 | Payload external upload trust validation issue | HIGH 7.2 | 0.1 % | ||
| CVE-2026-105860 | < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Tenant authorization bypass in Multi-Tenant Plugin | HIGH 7.1 | 0.2 % | ||
| CVE-2026-105859 | < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Unauthorized update to collection documents | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-105858 | < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Remote Code Execution through first-register | HIGH 8.1 | 0.5 % | ||
| CVE-2026-105857 | < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: RCE in Payload Form Builder | CRITICAL 10.0 | 0.4 % | ||
| CVE-2026-105856 | >= 3.0.0, < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: SQL injection in SQLite/Postgres | HIGH 8.6 | 0.3 % | ||
| CVE-2026-105855 | < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Field-level password update restrictions were not enforced | HIGH 7.6 | 0.2 % | ||
| CVE-2026-105854 | >= 3.0.0, < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: ReDoS in Multipart Content-Type Validation | HIGH 8.7 | 0.4 % | ||
| CVE-2026-105853 | >= 3.0.0, < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Token refresh and password reset responses may expose restricted user fields | HIGH 7.1 | 0.3 % | ||
| CVE-2026-105852 | < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload relationship-query authorization bypass | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-105851 | > 3.0.0, < 3.90.0 ; > 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Field access control bypass on auth collections | CRITICAL 9.3 | 0.2 % | ||
| CVE-2026-105850 | < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Order confirmation validation issue in Payload Ecommerce | HIGH 8.8 | 0.3 % | ||
| CVE-2026-105849 | >= 3.0.0, < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: API key disclosure through ordinary document reads | HIGH 7.7 | 0.3 % | ||
| CVE-2026-105848 | < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Insufficient Access Control in Stripe REST Proxy | MEDIUM 6.4 | 0.2 % | ||
| CVE-2026-105847 | >= 3.0.0, < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Polymorphic join queries could disclose hidden fields | HIGH 7.1 | 0.2 % | ||
| CVE-2026-105846 | >= 3.40.0, < 3.88.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.27 | Payload: Untrusted redirect URL parameter exploit | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-105845 | >= 3.0.0, < 3.88.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.27 | Payload: SQL Injection in SQLite and Postgres | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-105844 | >= 3.0.0, < 3.88.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.27 | Payload: Prototype pollution in Payload Import Export plugin | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-105806 | >= 3.61.0, < 3.88.0 | Payload: Improper access control for MCP API keys | HIGH 8.6 | 0.3 % | ||
| CVE-2026-105805 | < 3.88.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.27 | Payload: Sort queries could expose protected field information | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-105804 | >= 3.0.0, < 3.90.0 ; >= 4.0.0-canary.0, < 4.0.0-canary.34 | Payload: Password hashes use insufficient PBKDF2 iterations | MEDIUM 5.7 | 0.1 % | ||
| CVE-2026-93363 | 3.25.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-34750 | < 3.78.0 | Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-34749 | < 3.79.1 | Payload has a CSRF Protection Bypass in Authentication Flow | MEDIUM 5.4 | 0.1 % | ||
| CVE-2026-34748 | < 3.78.0 | @payloadcms/next has Stored XSS in Admin Panel | HIGH 8.7 | 0.3 % | ||
| CVE-2026-34747 | < 3.79.1 | Payload has an SQL Injection via Query Handling | HIGH 8.5 | 0.3 % | ||
| CVE-2026-34746 | < 3.79.1 | Payload has Authenticated SSRF via Upload Functionality | HIGH 7.7 | 0.3 % | ||
| CVE-2026-34751 | < 3.79.1 | Payload has Unvalidated Input in Password Recovery Endpoints | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-27567 | < 3.75.0 | Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-25544 | < 3.73.0 | Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters | CRITICAL 9.8 | 0.8 % | ||
| CVE-2026-25574 | < 3.74.0 | Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments) | MEDIUM 5.4 | 0.2 % | ||
| CVE-2023-30843 | < 1.7.0 | Payload's hidden fields can be leaked on readable collections | HIGH 7.4 | 0.6 % |