Payloadcms - vulnerabilities (CVEs)

42 CVEs in 13 products, 29 in the last 30 days, newest from 2026-10-06.

Products

• Payload - 39 CVEs
• Db-d1-sqlite - 1 CVEs
• Db-postgres - 1 CVEs
• Db-sqlite - 1 CVEs
• Db-vercel-postgres - 1 CVEs
• Next - 1 CVEs
• Payloadcms - 1 CVEs
• Plugin-ecommerce - 1 CVEs
• Plugin-import-export - 1 CVEs
• Plugin-mcp - 1 CVEs
• Plugin-multi-tenant - 1 CVEs
• Plugin-stripe - 1 CVEs
• Storage-s3 - 1 CVEs

Newest CVEs of Payloadcms

• CVE-2026-106100 - CVSS 7.1 (high), 2026-10-06: Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before…
• CVE-2026-105868 - CVSS 8.6 (high), 2026-10-06: Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload…
• CVE-2026-105867 - CVSS 7.1 (high), 2026-10-06: Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before…
• CVE-2026-105866 - CVSS 7.5 (high), 2026-10-06: Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated…
• CVE-2026-105865 - CVSS 8.1 (high), 2026-10-06: Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated…
• CVE-2026-105864 - CVSS 5.3 (medium), 2026-10-06: Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before…
• CVE-2026-105863 - CVSS 9.4 (critical), 2026-10-06: Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a…
• CVE-2026-105862 - CVSS 8.7 (high), 2026-10-06: Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that…
• CVE-2026-105861 - CVSS 8.2 (high), 2026-10-06: Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload…
• CVE-2026-105860 - CVSS 7.1 (high), 2026-10-06: Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before…
• CVE-2026-105859 - CVSS 9.8 (critical), 2026-10-06: Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can…
• CVE-2026-105858 - CVSS 8.1 (high), 2026-10-06: Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request…
• CVE-2026-105857 - CVSS 10 (critical), 2026-10-06: Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before…
• CVE-2026-105856 - CVSS 8.6 (high), 2026-10-06: Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access…
• CVE-2026-105855 - CVSS 7.6 (high), 2026-10-06: Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails…
• CVE-2026-105854 - CVSS 8.7 (high), 2026-10-06: Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a…
• CVE-2026-105853 - CVSS 7.1 (high), 2026-10-06: Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token…
• CVE-2026-105852 - CVSS 7.5 (high), 2026-10-06: Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a…
• CVE-2026-105851 - CVSS 9.3 (critical), 2026-10-06: Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the…
• CVE-2026-105850 - CVSS 8.8 (high), 2026-10-06: Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before…
• CVE-2026-105849 - CVSS 8.3 (high), 2026-10-06: Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users…
• CVE-2026-105848 - CVSS 9.6 (critical), 2026-10-06: Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before…
• CVE-2026-105847 - CVSS 7.1 (high), 2026-10-06: Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user…
• CVE-2026-105846 - CVSS 6.1 (medium), 2026-10-06: Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an…
• CVE-2026-105845 - CVSS 9.8 (critical), 2026-10-06: Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an…
• CVE-2026-105844 - CVSS 9.3 (critical), 2026-10-06: Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an…
• CVE-2026-105806 - CVSS 8.6 (high), 2026-10-06: Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can…
• CVE-2026-105805 - CVSS 6.9 (medium), 2026-10-06: Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user…
• CVE-2026-105804 - CVSS 5.7 (medium), 2026-10-06: Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before…
• CVE-2026-93363 - CVSS 5.3 (medium), 2026-09-25: The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass…