@frogbotai/plugin-stripe (>=0.14.0, <=0.23.0) potentially affected by CVE-2026-105848 via @payloadcms/plugin-stripe (>=3.85.1, <=3.88.0)

@payloadcms/plugin-stripe NPM version =3.85.1, =0.14.0, =0.23.0 Source cves: CVE-2026-105848 Source advisory: GHSA-R9V2-GG2J-22Q5...

Payload: Improper access control for MCP API keys

Impact Under certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover. Applications that do not use @payloadcms/plugin-mcp are not affected. Patches Users should upgrade to...

GHSA-2Q76-M6W6-QGC6 Payload: Improper access control for MCP API keys

Impact Under certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover. Applications that do not use @payloadcms/plugin-mcp are not affected. Patches Users should upgrade to...

@frogbotai/plugin-mcp (>=0.14.0, <=0.21.0), @justanarthur/payload-www (>=1.0.1, <=1.4.2) +1 more potentially affected by CVE-2026-105806 via @payloadcms/plugin-mcp (>=3.85.0, <=3.87.1)

@payloadcms/plugin-mcp NPM version =3.85.0, =0.14.0, =1.0.1, =0.6.0, =0.7.0 Source cves: CVE-2026-105806 Source advisory: OSV:GHSA-2Q76-M6W6-QGC6...

@frogbotai/plugin-mcp (>=0.14.0, <=0.21.0), @justanarthur/payload-www (>=1.0.1, <=1.4.2) +1 more potentially affected by CVE-2026-105806 via @payloadcms/plugin-mcp (>=3.85.0, <=3.87.1)

@payloadcms/plugin-mcp NPM version =3.85.0, =0.14.0, =1.0.1, =0.6.0, =0.7.0 Source cves: CVE-2026-105806 Source advisory: GHSA-2Q76-M6W6-QGC6...

@frogbotai/plugin-import-export (>=0.14.0, <=0.21.0) potentially affected by CVE-2026-105844 via @payloadcms/plugin-import-export (3.85.1)

@payloadcms/plugin-import-export NPM version 3.85.1 is affected by a known vulnerability. The following packages have a transitive dependency on @payloadcms/plugin-import-export and may be impacted: - @frogbotai/plugin-import-export =0.14.0, =0.21.0 Source cves: CVE-2026-105844 Source advisory:...

@frogbotai/plugin-import-export (>=0.14.0, <=0.21.0) potentially affected by CVE-2026-105844 via @payloadcms/plugin-import-export (3.85.1)

@payloadcms/plugin-import-export NPM version 3.85.1 is affected by a known vulnerability. The following packages have a transitive dependency on @payloadcms/plugin-import-export and may be impacted: - @frogbotai/plugin-import-export =0.14.0, =0.21.0 Source cves: CVE-2026-105844 Source advisory:...

GHSA-QF28-8HC6-VWRP Payload: Prototype pollution in Payload Import Export plugin

Impact An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code RCE. Applications that do not use @payloadcms/plugin-import-export are not affected. Patches Users should upgrade Payload...

Payload: Prototype pollution in Payload Import Export plugin

Impact An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code RCE. Applications that do not use @payloadcms/plugin-import-export are not affected. Patches Users should upgrade Payload...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105845 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105845 Source advisory: OSV:GHSA-V49J-62M6-PGRR...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105845 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105845 Source advisory: GHSA-V49J-62M6-PGRR...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105845 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105845 Source advisory: SNYK:JS-PAYLOAD-20571753...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: SNYK:JS-PAYLOAD-20571762...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: GHSA-W84C-53H3-MC2G...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: OSV:GHSA-W84C-53H3-MC2G...

@payloadcms/plugin-search (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via @payloadcms/next (>=4.0.0-canary.0, <=4.0.0-canary.26)

@payloadcms/next NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: GHSA-W84C-53H3-MC2G...

@payloadcms/plugin-search (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via @payloadcms/next (>=4.0.0-canary.0, <=4.0.0-canary.26)

@payloadcms/next NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: OSV:GHSA-W84C-53H3-MC2G...

@payloadcms/plugin-search (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via @payloadcms/next (>=4.0.0-canary.0, <=4.0.0-canary.26)

@payloadcms/next NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: SNYK:JS-PAYLOADCMSNEXT-20571761...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105847 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105847 Source advisory: OSV:GHSA-FPWW-C55P-CJV6...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105847 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105847 Source advisory: GHSA-FPWW-C55P-CJV6...