@payloadcms vulnerabilities
8 published CVEs name @payloadcms among the affected products.
- 8Published CVEs8 of them scored
- 8Last 12 monthspublished in the last year
- 1Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-105867
Payload: Client uploads could overwrite S3 objects
payloadcms · payload
High7.1 - CVE-2026-105864
Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant
payloadcms · payload
Medium5.3 - CVE-2026-105856
Payload: SQL injection in SQLite/Postgres
payloadcms · payload
High8.6 - CVE-2026-105850
Payload: Order confirmation validation issue in Payload Ecommerce
payloadcms · payload
High8.8 - CVE-2026-105848
Payload: Insufficient Access Control in Stripe REST Proxy
payloadcms · payload
Medium6.4 - CVE-2026-105846
Payload: Untrusted redirect URL parameter exploit
payloadcms · payload
Medium6.1 - CVE-2026-105844
Payload: Prototype pollution in Payload Import Export plugin
payloadcms · payload
Critical9.3 - CVE-2026-105806
Payload: Improper access control for MCP API keys
payloadcms · payload
High8.6