EUVD-2026-93493

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions...

CVE-2026-105850

The Payload headless content management system is vulnerable in @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34 . When using the Stripe payment adapter , certain conditions can cause a Stripe order confirmation to be processed more than once. This is...

GHSA-R9V2-GG2J-22Q5 Payload: Insufficient Access Control in Stripe REST Proxy

Impact An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy. You are affected if ALL of these are true: - Your application uses @payloadcms/plugin-stripe. - The optional Stripe REST proxy is enabled. - An authenticated user can reach the proxy...

Payload: Insufficient Access Control in Stripe REST Proxy

Impact An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy. You are affected if ALL of these are true: - Your application uses @payloadcms/plugin-stripe. - The optional Stripe REST proxy is enabled. - An authenticated user can reach the proxy...

GHSA-2Q76-M6W6-QGC6 Payload: Improper access control for MCP API keys

Impact Under certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover. Applications that do not use @payloadcms/plugin-mcp are not affected. Patches Users should upgrade to...

Payload: Improper access control for MCP API keys

Impact Under certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover. Applications that do not use @payloadcms/plugin-mcp are not affected. Patches Users should upgrade to...

@adenta/cms (>=0.0.6, <=1.1.1-0), @frogbotai/next (>=0.2.2, <=0.20.0) +14 more potentially affected by CVE-2026-105846 via @payloadcms/next (>=3.31.0, <=3.87.1)

@payloadcms/next NPM version =3.31.0, =0.0.6, =0.2.2, =0.14.0, =0.1.2, =1.0.2, =3.31.0, =1.0.54, =1.0.0, =1.0.0, =1.53.40, =1.53.45 and more Source cves: CVE-2026-105846 Source advisory: OSV:GHSA-W84C-53H3-MC2G...

@payloadcms/plugin-search (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via @payloadcms/next (>=4.0.0-canary.0, <=4.0.0-canary.26)

@payloadcms/next NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: SNYK:JS-PAYLOADCMSNEXT-20571761...

@payloadcms/plugin-search (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via @payloadcms/next (>=4.0.0-canary.0, <=4.0.0-canary.26)

@payloadcms/next NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: OSV:GHSA-W84C-53H3-MC2G...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect through the getSafeRedirect utility in packages/payload/src/utilities/getSafeRedirect.ts and the authentication forms in examples/auth/src/app/app/login/LoginForm/index.tsx and...

EUVD-2026-93490

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

CVE-2026-105844

Payload , a headless content management system, contains a prototype pollution vulnerability in the @payloadcms/plugin-import-export plugin. An unauthenticated user can submit prototype-sensitive field paths, leading to unintended application behavior and potential remote code execution (RCE) . T...

CVE-2026-105844 Payload: Prototype pollution in Payload Import Export plugin

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended applicatio...

EUVD-2026-93470

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended applicatio...

CVE-2026-105844

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended applicatio...

CVE-2026-105806

The Payload headless content management system is vulnerable in the @payloadcms/plugin-mcp component (versions 3.61.0 through 3.88.0 ). Due to improper access control , an authenticated user can manage MCP API keys outside of their intended account, which may lead to privilege escalation through ...

CVE-2026-105806 Payload: Improper access control for MCP API keys

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

CVE-2026-105806 Payload: Improper access control for MCP API keys

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...