@ainsleydev/payload-helper (>=0.0.25, <=0.3.2), @davincicoding/payload-plugin-kit (0.0.4) +10 more potentially affected by CVE-2026-63316 via @payloadcms/db-sqlite (>=3.5.0, <=3.88.0)

@payloadcms/db-sqlite NPM version =3.5.0, =0.0.25, =0.0.1, =1.1.10, =1.2.0 - payload-smart-deletion 1.0.7 - simple-shop 1.0.0 Source cves: CVE-2026-63316 Source advisory: SNYK:JS-PAYLOADCMSDBSQLITE-20936943...

@adenta/cms (>=0.0.6, <=1.1.1-0), @lafllamme/personal-page-shared (>=1.0.0, <=1.2.0) +2 more potentially affected by CVE-2026-63316 via @payloadcms/db-postgres (>=3.46.0, <=3.61.0)

@payloadcms/db-postgres NPM version =3.46.0, =0.0.6, =1.0.0, =1.2.0 - @otherdev-software/canvas 1.0.0 - payload-auth-plugin 0.7.5 Source cves: CVE-2026-63316 Source advisory: SNYK:JS-PAYLOADCMSDBPOSTGRES-20936944...

@frogbotai/db-d1-sqlite (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-63316 via @payloadcms/db-d1-sqlite (>=3.85.1, <=3.88.0)

@payloadcms/db-d1-sqlite NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-63316 Source advisory: SNYK:JS-PAYLOADCMSDBD1SQLITE-20936945...

SQL Injection

Overview @payloadcms/db-d1-sqlite is a The officially supported D1 SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via improper escaping of string values in parseParams when constructing JSON queries for in and notin operators. An authenticate...

SQL Injection

Overview @payloadcms/db-postgres is a The officially supported Postgres database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via improper escaping of string values in parseParams when constructing JSON queries for in and notin operators. An authenticated...

SQL Injection

Overview @payloadcms/plugin-mcp is a MCP Model Context Protocol capabilities with Payload Affected versions of this package are vulnerable to SQL Injection via improper escaping of string values in parseParams when constructing JSON queries for in and notin operators. An authenticated attacker ca...

SQL Injection

Overview @payloadcms/db-sqlite is a The officially supported SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via improper escaping of string values in parseParams when constructing JSON queries for in and notin operators. An authenticated...

Missing Authorization

Payload CMS is vulnerable to Missing Authorization. The vulnerability is due to insufficient tenant-level authorization checks during record creation in @payloadcms/plugin-multi-tenant, which allows an authenticated user restricted to one tenant to create records in another tenant, bypassing tena...

Authorization Bypass

Payload CMS is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access controls on the default tenant array field in @payloadcms/plugin-multi-tenant, which allows an authenticated attacker to assign their own account to other tenants and gain unauthorized cross-tenant...

WS-2026-0144

@payloadcms/plugin-mcp 3.64.0 through 3.87.1 and four 4.0.0-internal builds from May 2026: an operator-precedence bug in the default MCP API-key resolver made it ignore the key passed by a custom overrideAuth function and authenticate with the request's Authorization bearer header instead, so...

@frogbotai/plugin-mcp (>=0.14.0, <=0.21.0), @justanarthur/payload-www (>=1.0.1, <=1.4.2) +1 more potentially affected by unknown CVE via @payloadcms/plugin-mcp (>=3.85.0, <=3.87.1)

@payloadcms/plugin-mcp NPM version =3.85.0, =0.14.0, =1.0.1, =0.6.0, =0.7.0 Source cves: unknown CVE Source advisory: MEND:WS-2026-0144...

@ainsleydev/payload-helper (>=0.0.25, <=0.3.2), @davincicoding/payload-plugin-kit (0.0.4) +10 more potentially affected by CVE-2026-105856 via @payloadcms/db-sqlite (>=3.5.0, <=3.88.0)

@payloadcms/db-sqlite NPM version =3.5.0, =0.0.25, =0.0.1, =1.1.10, =1.2.0 - payload-smart-deletion 1.0.7 - simple-shop 1.0.0 Source cves: CVE-2026-105856 Source advisory: SNYK:JS-PAYLOADCMSDBSQLITE-20936902...

@adenta/cms (>=0.0.6, <=1.1.1-0), @lafllamme/personal-page-shared (>=1.0.0, <=1.2.0) +2 more potentially affected by CVE-2026-105856 via @payloadcms/db-postgres (>=3.46.0, <=3.61.0)

@payloadcms/db-postgres NPM version =3.46.0, =0.0.6, =1.0.0, =1.2.0 - @otherdev-software/canvas 1.0.0 - payload-auth-plugin 0.7.5 Source cves: CVE-2026-105856 Source advisory: SNYK:JS-PAYLOADCMSDBPOSTGRES-20936900...

@frogbotai/db-d1-sqlite (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-105856 via @payloadcms/db-d1-sqlite (>=3.85.1, <=3.88.0)

@payloadcms/db-d1-sqlite NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-105856 Source advisory: SNYK:JS-PAYLOADCMSDBD1SQLITE-20936901...

@adenta/cms (>=0.0.6, <=1.1.1-0), @lafllamme/personal-page-shared (>=1.0.0, <=1.2.0) +2 more potentially affected by CVE-2026-105856 +1 more via @payloadcms/db-postgres (>=3.46.0, <=3.61.0)

@payloadcms/db-postgres NPM version =3.46.0, =0.0.6, =1.0.0, =1.2.0 - @otherdev-software/canvas 1.0.0 - payload-auth-plugin 0.7.5 Source cves: CVE-2026-105856, CVE-2026-63316 Source advisory: OSV:GHSA-PJ7X-6WPF-PGVP...

@adenta/cms (>=0.0.6, <=1.1.1-0), @lafllamme/personal-page-shared (>=1.0.0, <=1.2.0) +2 more potentially affected by CVE-2026-105856 via @payloadcms/db-postgres (>=3.46.0, <=3.61.0)

@payloadcms/db-postgres NPM version =3.46.0, =0.0.6, =1.0.0, =1.2.0 - @otherdev-software/canvas 1.0.0 - payload-auth-plugin 0.7.5 Source cves: CVE-2026-105856 Source advisory: GHSA-PJ7X-6WPF-PGVP...

@frogbotai/db-d1-sqlite (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-105856 +1 more via @payloadcms/db-d1-sqlite (>=3.85.1, <=3.88.0)

@payloadcms/db-d1-sqlite NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-105856, CVE-2026-63316 Source advisory: OSV:GHSA-PJ7X-6WPF-PGVP...

@frogbotai/db-d1-sqlite (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-105856 via @payloadcms/db-d1-sqlite (>=3.85.1, <=3.88.0)

@payloadcms/db-d1-sqlite NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-105856 Source advisory: GHSA-PJ7X-6WPF-PGVP...

@ainsleydev/payload-helper (>=0.0.25, <=0.3.2), @davincicoding/payload-plugin-kit (0.0.4) +10 more potentially affected by CVE-2026-105856 +1 more via @payloadcms/db-sqlite (>=3.5.0, <=3.88.0)

@payloadcms/db-sqlite NPM version =3.5.0, =0.0.25, =0.0.1, =1.1.10, =1.2.0 - payload-smart-deletion 1.0.7 - simple-shop 1.0.0 Source cves: CVE-2026-105856, CVE-2026-63316 Source advisory: OSV:GHSA-PJ7X-6WPF-PGVP...

@ainsleydev/payload-helper (>=0.0.25, <=0.3.2), @davincicoding/payload-plugin-kit (0.0.4) +10 more potentially affected by CVE-2026-105856 via @payloadcms/db-sqlite (>=3.5.0, <=3.88.0)

@payloadcms/db-sqlite NPM version =3.5.0, =0.0.25, =0.0.1, =1.1.10, =1.2.0 - payload-smart-deletion 1.0.7 - simple-shop 1.0.0 Source cves: CVE-2026-105856 Source advisory: GHSA-PJ7X-6WPF-PGVP...