Vulnerabilities

TI-2026-68620 CVE-2026-106100 · GHSA-4ww4-68q3-h7g5

Field-level write access bypass in Payload on MongoDB

LOW 31

Payload is a free and open source headless content management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00216 Published 2026-10-06 Fixed in 3.87.0, 4.0.0-canary.20 CWE-639

TI-2026-68617 CVE-2026-105868 · GHSA-9qpg-3cf8-w33x

Uploaded XML files can run JavaScript in Payload CMS

MEDIUM 44

Payload is a free and open source headless content management system.

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.00165 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-434

TI-2026-68616 CVE-2026-105867 · GHSA-7vg8-29qx-jgj8

Payload storage-s3 uploads can overwrite objects in other collections

LOW 31

Payload is a free and open source headless content management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0022 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-639

TI-2026-68615 CVE-2026-105866 · GHSA-v5gf-vpjc-pc7w

Payload CMS account lockout lets attackers block user sign-in

LOW 37

Payload is a free and open source headless content management system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00369 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-307

TI-2026-68614 CVE-2026-105865 · GHSA-p223-2wr2-j562

Path traversal in Payload CMS upload cleanup deletes unintended files

LOW 37

Payload is a free and open source headless content management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00379 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-22

TI-2026-68613 CVE-2026-105864 · GHSA-xhm9-gwgw-3q2q

Cross-tenant record creation in Payload plugin-multi-tenant

LOW 23

Payload is a free and open source headless content management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00196 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-863

TI-2026-68612 CVE-2026-105863 · GHSA-66wr-7vmr-p5jq

Payload authentication token field handling issue

MEDIUM 48

Payload is a free and open source headless content management system.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00549 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-290

TI-2026-68611 CVE-2026-105862 · GHSA-2pwp-2369-8fg3

Sanitization bypass lets uploaded SVG files run JavaScript in Payload

LOW 39

Payload is a free and open source headless content management system.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00271 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-434

TI-2026-68610 CVE-2026-105861 · GHSA-pj5h-5q6c-3pfx

Payload forwards authentication data to unverified redirect targets

LOW 31

Payload is a free and open source headless content management system.

CVSS 4.0HIGH 7.2 Network Low privileges User interaction EPSS 0.00133 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-200

TI-2026-68609 CVE-2026-105860 · GHSA-p96c-xwx8-3cqj

Tenant authorization bypass in Payload Multi-Tenant Plugin

LOW 31

Payload is a free and open source headless content management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00193 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-862

TI-2026-68608 CVE-2026-105859 · GHSA-f7hx-52q9-hcrf

Payload CMS lets attackers update collection documents

MEDIUM 49

Payload is a free and open source headless content management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00347 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-639

TI-2026-68607 CVE-2026-105858 · GHSA-97rh-rhh2-7vjv

Remote code execution in Payload through first-register

LOW 38

Payload is a free and open source headless content management system.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00475 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-1321

TI-2026-68606 CVE-2026-105857 · GHSA-r488-j9vj-wx3q

Remote code execution in Payload Form Builder plugin

MEDIUM 49

Payload is a free and open source headless content management system.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00429 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-1321

TI-2026-68605 CVE-2026-105856 · GHSA-pj7x-6wpf-pgvp

SQL injection in Payload CMS SQLite and Postgres adapters

LOW 37

Payload is a free and open source headless content management system.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00294 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 +1 CWE-89

TI-2026-68604 CVE-2026-105855 · GHSA-fx49-4h83-wjv9

Payload: Field-level password update restrictions were not enforced

LOW 35

Payload is a free and open source headless content management system.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00248 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-284

TI-2026-68603 CVE-2026-105854 · GHSA-2g7p-5934-q4w7

Regex slowdown in Payload CMS multipart Content-Type validation

MEDIUM 44

Payload is a free and open source headless content management system.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00354 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-1333

TI-2026-68491 CVE-2026-105853 · GHSA-xgv3-crq2-6f69

Payload token and password reset responses expose restricted fields

LOW 37

Payload is a free and open source headless content management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00257 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-200

TI-2026-68490 CVE-2026-105852 · GHSA-7c34-32v3-j575

Authorization bypass in Payload relationship queries exposes related documents

LOW 36

Payload is a free and open source headless content management system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00268 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-862

TI-2026-68489 CVE-2026-105851

Field access control bypass in Payload duplicate operation

MEDIUM 46

Payload is a free and open source headless content management system.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00249 Published 2026-10-06 No fix listed CWE-284

TI-2026-68488 CVE-2026-105850 · GHSA-8r29-2mp2-pmrw

Repeated Stripe order confirmation processing in Payload Ecommerce

MEDIUM 44

Payload is a free and open source headless content management system.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00308 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-837

TI-2026-68487 CVE-2026-105849 · GHSA-238x-w2j9-gwwr

API key disclosure in Payload CMS through ordinary document reads

LOW 35

Payload is a free and open source headless content management system.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.003 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-201

TI-2026-68486 CVE-2026-105848 · GHSA-r9v2-gg2j-22q5

Insufficient access control in Payload's Stripe REST proxy

LOW 30

Payload is a free and open source headless content management system.

CVSS 4.0MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00244 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-749

TI-2026-68485 CVE-2026-105847 · GHSA-fpww-c55p-cjv6

Payload CMS polymorphic join queries could disclose hidden fields

LOW 31

Payload is a free and open source headless content management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00244 Published 2026-10-06 Fixed in 3.90.0, 4.0.0-canary.34 CWE-200

TI-2026-68484 CVE-2026-105846 · GHSA-w84c-53h3-mc2g

Open redirect in Payload CMS sends guests to untrusted sites

LOW 27

Payload is a free and open source headless content management system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00225 Published 2026-10-06 Fixed in 3.88.0, 4.0.0-canary.27 CWE-601

TI-2026-68480 CVE-2026-105845 · GHSA-v49j-62m6-pgrr

SQL injection in Payload SQLite and Postgres adapters

MEDIUM 49

Payload is a free and open source headless content management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00381 Published 2026-10-06 Fixed in 3.88.0, 4.0.0-canary.27 CWE-89

Vulnerabilities

Filters