@basildesignco/payload-preset (0.1.0), @frogbotai/storage-vercel-blob (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-105862 via @payloadcms/storage-vercel-blob (>=3.85.1, <=3.89.0)

@payloadcms/storage-vercel-blob NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-105862 Source advisory: SNYK:JS-PAYLOADCMSSTORAGEVERCELBLOB-20570518...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated...

@basildesignco/payload-preset (0.1.0), @frogbotai/storage-vercel-blob (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-105868 via @payloadcms/storage-vercel-blob (>=3.85.1, <=3.89.0)

@payloadcms/storage-vercel-blob NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-105868 Source advisory: SNYK:JS-PAYLOADCMSSTORAGEVERCELBLOB-20570544...

Arbitrary File Upload

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData an...

@payloadcms/db-d1-sqlite (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/db-postgres (>=4.0.0-canary.0, <=4.0.0-canary.33) +2 more potentially affected by CVE-2026-105856 via @payloadcms/drizzle (>=4.0.0-canary.0, <=4.0.0-canary.33)

@payloadcms/drizzle NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105856 Source advisory: MEND:CVE-2026-105856...

@payloadcms/db-d1-sqlite (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/db-postgres (>=4.0.0-canary.0, <=4.0.0-canary.33) +2 more potentially affected by CVE-2026-105852 via @payloadcms/drizzle (>=4.0.0-canary.0, <=4.0.0-canary.33)

@payloadcms/drizzle NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105852 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-20571386...

Missing Authorization

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Missing Authorization in the getClientUploadRoute handler for the client-upload path. An attacker can upload files by sending a client upload request t...

@basildesignco/payload-preset (0.1.0), @frogbotai/storage-vercel-blob (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-93363 via @payloadcms/storage-vercel-blob (>=3.85.1, <=3.89.0)

@payloadcms/storage-vercel-blob NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-93363 Source advisory: SNYK:JS-PAYLOADCMSSTORAGEVERCELBLOB-20158638...

Malicious Package

Overview vercel-runtime-python is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

@basildesignco/payload-preset (0.1.0), @frogbotai/storage-vercel-blob (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-93363 via @payloadcms/storage-vercel-blob (>=3.85.1, <=3.89.0)

@payloadcms/storage-vercel-blob NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-93363 Source advisory: MEND:CVE-2026-93363...

CVE-2026-93363 Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

CVE-2026-93363 Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

CVE-2026-93363 Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

EUVD-2026-87206

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability. Authenticated users can bypass collection-level permissions by directly accessing the client-upload route , allowing them to upload files without the required permissions and circumv...

CVE-2026-93363: Missing Authorization

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

PT-2026-98951

Name of the Vulnerable Software and Affected Versions @payloadcms/storage-vercel-blob affected versions not specified Description Improper access control in the storage adapter allows authenticated users to bypass collection-level permissions. By directly accessing the 'client-upload' endpoint,...

MAL-2026-17168 Malicious code in vercel-runtime-python (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f59b48451cf996ea42b291d60ed56205aeb9803222d156f7880fd6b92032b1c6 The package presents itself as a Vercel Python runtime helper but ships no runtime functionality. Its only substantive code path is a public function...