payloadcms vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 202640

Newest CVEs

• CVE-2026-106100

  Payload: Field-level write access bypass in Payload on MongoDB

  payloadcms · payload

  High7.1
• CVE-2026-105868

  Payload: Uploaded XML files could execute same-origin JavaScript

  payloadcms · payload

  High8.6
• CVE-2026-105867

  Payload: Client uploads could overwrite S3 objects

  payloadcms · payload

  High7.1
• CVE-2026-105866

  Payload: Unauthenticated account-lockout denial of service

  payloadcms · payload

  Medium6.9
• CVE-2026-105865

  Payload: Incomplete validation during the upload file lifecycle

  payloadcms · payload

  High8.1
• CVE-2026-105864

  Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant

  payloadcms · payload

  Medium5.3
• CVE-2026-105863

  Payload authentication token field handling issue

  payloadcms · payload

  Critical9.2
• CVE-2026-105862

  Payload: Bypassed sanitization of user uploaded SVGs

  payloadcms · payload

  High8.7
• CVE-2026-105861

  Payload external upload trust validation issue

  payloadcms · payload

  High7.2
• CVE-2026-105860

  Payload: Tenant authorization bypass in Multi-Tenant Plugin

  payloadcms · payload

  High7.1