Payloadcms

12 CVEs across 2 Payloadcms products. Browse Payloadcms vulnerabilities, severities, and proof-of-concept exploits.

Payloadcms products with known CVEs

Product	CVEs
Payload	11
Payloadcms	1

Payloadcms CVEs — newest first
CVE	Severity	Score	Published	Summary
`CVE-2026-11779`			2026-06-26	An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.
`CVE-2026-34750`	Medium	`6.5`	2026-04-01	Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcm…
`CVE-2026-34749`	Medium	`5.4`	2026-04-01	Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the…
`CVE-2026-34748`	High	`8.7`	2026-04-01	Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerab…
`CVE-2026-34747`	High	`8.5`	2026-04-01	Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker…
`CVE-2026-34746`	High	`7.7`	2026-04-01	Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerabilit…
`CVE-2026-34751`	Critical	`9.1`	2026-04-01	Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the passwo…
`CVE-2026-27567`	Medium	`6.5`	2026-02-24	Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Payload's e…
`CVE-2026-25574`	Medium	`5.4`	2026-02-06	Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability…
`CVE-2026-25544`	Critical	`9.8`	2026-02-06	Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded…
`CVE-2023-30843`	High	`7.4`	2023-04-26	Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields…
`CVE-2022-27952`	Critical	`9.8`	2022-04-12	An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.