What’s Vulnerable › Products
payloadcms payload vulnerabilities
41 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 39 published in the last 12 months.
Check whether your payloadcms payload version is affected
Latest payloadcms payload vulnerabilities
- CVE-2026-106100 — Payload: Field-level write access bypass in Payload on MongoDB (CVSS 7.1)
- CVE-2026-105868 — Payload: Uploaded XML files could execute same-origin JavaScript (CVSS 7.1)
- CVE-2026-105867 — Payload: Client uploads could overwrite S3 objects (CVSS 6.5)
- CVE-2026-105866 — Payload: Unauthenticated account-lockout denial of service (CVSS 7.5)
- CVE-2026-105865 — Payload: Incomplete validation during the upload file lifecycle (CVSS 8.1)
- CVE-2026-105864 — Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant (CVSS 4.3)
- CVE-2026-105863 — Payload authentication token field handling issue (CVSS 9.4)
- CVE-2026-105862 — Payload: Bypassed sanitization of user uploaded SVGs (CVSS 8.7)
- CVE-2026-105861 — Payload external upload trust validation issue (CVSS 8.2)
- CVE-2026-105860 — Payload: Tenant authorization bypass in Multi-Tenant Plugin (CVSS 7.1)
- CVE-2026-105859 — Payload: Unauthorized update to collection documents (CVSS 9.8)
- CVE-2026-105858 — Payload: Remote Code Execution through first-register (CVSS 8.1)
- CVE-2026-105857 — Payload: RCE in Payload Form Builder (CVSS 10.0)
- CVE-2026-105856 — Payload: SQL injection in SQLite/Postgres (CVSS 8.3)
- CVE-2026-105855 — Payload: Field-level password update restrictions were not enforced (CVSS 7.1)
- CVE-2026-105854 — Payload: ReDoS in Multipart Content-Type Validation (CVSS 7.5)
- CVE-2026-105853 — Payload: Token refresh and password reset responses may expose restricted user fields (CVSS 6.5)
- CVE-2026-105852 — Payload relationship-query authorization bypass (CVSS 7.5)
- CVE-2026-105851 — Payload: Field access control bypass on auth collections (CVSS 8.1)
- CVE-2026-105850 — Payload: Order confirmation validation issue in Payload Ecommerce (CVSS 8.2)
- CVE-2026-105849 — Payload: API key disclosure through ordinary document reads (CVSS 8.3)
- CVE-2026-105848 — Payload: Insufficient Access Control in Stripe REST Proxy (CVSS 9.6)
- CVE-2026-105847 — Payload: Polymorphic join queries could disclose hidden fields (CVSS 6.5)
- CVE-2026-105846 — Payload: Untrusted redirect URL parameter exploit (CVSS 6.1)
- CVE-2026-105845 — Payload: SQL Injection in SQLite and Postgres (CVSS 9.8)