Filtered by vendor Payloadcms
Subscribe
Total
35 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-34748 | 1 Payloadcms | 1 Payload | 2026-10-26 | N/A | 8.7 HIGH |
| Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. This issue has been patched in version 3.78.0. | |||||
| CVE-2026-34747 | 1 Payloadcms | 1 Payload | 2026-10-26 | N/A | 8.5 HIGH |
| Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patched in version 3.79.1. | |||||
| CVE-2026-34746 | 1 Payloadcms | 1 Payload | 2026-10-26 | N/A | 7.7 HIGH |
| Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. This issue has been patched in version 3.79.1. | |||||
| CVE-2026-34751 | 1 Payloadcms | 1 Payload | 2026-10-26 | N/A | 9.1 CRITICAL |
| Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload. | |||||
| CVE-2026-34749 | 1 Payloadcms | 1 Payload | 2026-10-26 | N/A | 5.4 MEDIUM |
| Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. This issue has been patched in version 3.79.1. | |||||
| CVE-2026-34750 | 1 Payloadcms | 1 Payload | 2026-10-25 | N/A | 6.5 MEDIUM |
| Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. This issue has been patched in version 3.78.0 for @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3. | |||||
| CVE-2026-105846 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 6.1 MEDIUM |
| Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27. | |||||
| CVE-2026-105847 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 6.5 MEDIUM |
| Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset tokens, through polymorphic join filters. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | |||||
| CVE-2026-105868 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 7.1 HIGH |
| Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | |||||
| CVE-2026-105848 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 9.6 CRITICAL |
| Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | |||||
| CVE-2026-105849 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 8.3 HIGH |
| Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | |||||
| CVE-2026-105850 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 8.2 HIGH |
| Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | |||||
| CVE-2026-105851 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 8.1 HIGH |
| Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | |||||
| CVE-2026-105852 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 7.5 HIGH |
| Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | |||||
| CVE-2026-105853 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 6.5 MEDIUM |
| Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot access. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | |||||
| CVE-2026-105854 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 7.5 HIGH |
| Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | |||||
| CVE-2026-105855 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 7.1 HIGH |
| Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | |||||
| CVE-2026-105856 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 8.3 HIGH |
| Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite packages are fixed in versions 3.90.0 and 4.0.0-canary.34, and the Postgres packages are fixed in version 3.73.0. | |||||
| CVE-2026-105857 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 10.0 CRITICAL |
| Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | |||||
| CVE-2026-105858 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 8.1 HIGH |
| Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | |||||