@payloadcms vulnerabilities

Newest CVEs

• CVE-2026-105867

  Payload: Client uploads could overwrite S3 objects

  payloadcms · payload

  High7.1
• CVE-2026-105864

  Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant

  payloadcms · payload

  Medium5.3
• CVE-2026-105856

  Payload: SQL injection in SQLite/Postgres

  payloadcms · payload

  High8.6
• CVE-2026-105850

  Payload: Order confirmation validation issue in Payload Ecommerce

  payloadcms · payload

  High8.8
• CVE-2026-105848

  Payload: Insufficient Access Control in Stripe REST Proxy

  payloadcms · payload

  Medium6.4
• CVE-2026-105846

  Payload: Untrusted redirect URL parameter exploit

  payloadcms · payload

  Medium6.1
• CVE-2026-105844

  Payload: Prototype pollution in Payload Import Export plugin

  payloadcms · payload

  Critical9.3
• CVE-2026-105806

  Payload: Improper access control for MCP API keys

  payloadcms · payload

  High8.6