@01.software/sdk (>=0.0.1-251022.145258, <=0.2.3), @adenta/cms (>=0.0.6, <=1.1.1-0) +71 more potentially affected by CVE-2026-34748 via @payloadcms/ui (>=3.0.0, <=3.77.0-internal.9837b1e)

@payloadcms/ui NPM version =3.0.0, =0.0.1-251022.145258, =0.0.6, =3.70.0, =0.0.3, =3.39.2, =1.0.1-beta.3, =0.1.2, =0.0.1, =1.0.0, =0.1.0, =0.1.2, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-34748 Source advisory: SNYK:JS-PAYLOADCMSUI-15873862...

CVE-2026-34748 @payloadcms/next has Stored XSS in Admin Panel

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting XSS vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another...