CVE Tools
Track your stack

Payloadcms

35 CVEs tracked since 2026. Since Apr 2026, none of them reached CISA KEV.

Payloadcms CVEs per month

Apr 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Payloadcms CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-0460
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-10290

Products

The products that kept showing up in Payloadcms's monthly top three, with their CVEs summed over those months.

  1. Payload352 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Payloadcms.

  1. CVE-2026-106100Payload: Field-level write access bypass in Payload on MongoDB7.1
  2. CVE-2026-105868Payload: Uploaded XML files could execute same-origin JavaScript—
  3. CVE-2026-105867Payload: Client uploads could overwrite S3 objects—
  4. CVE-2026-105866Payload: Unauthenticated account-lockout denial of service—
  5. CVE-2026-105865Payload: Incomplete validation during the upload file lifecycle8.1
  6. CVE-2026-105864Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant—
  7. CVE-2026-105863Payload authentication token field handling issue—
  8. CVE-2026-105862Payload: Bypassed sanitization of user uploaded SVGs8.7
  9. CVE-2026-105861Payload external upload trust validation issue—
  10. CVE-2026-105860Payload: Tenant authorization bypass in Multi-Tenant Plugin—
  11. CVE-2026-105859Payload: Unauthorized update to collection documents9.8
  12. CVE-2026-105858Payload: Remote Code Execution through first-register8.1
  13. CVE-2026-105857Payload: RCE in Payload Form Builder10.0
  14. CVE-2026-105856Payload: SQL injection in SQLite/Postgres—
  15. CVE-2026-105855Payload: Field-level password update restrictions were not enforced—

The record

Peak rank
#21 in Oct 2026
Busiest month shown
Oct 2026, 29 CVEs
Months with a KEV entry
0 since Apr 2026
Monthly snapshots
2 since 2026
Payloadcms's full record, month by month