@ainsleydev/payload-helper (0.0.16), @contentql/core (>=0.1.2, <=0.3.5) +2 more potentially affected by CVE-2026-34750 via @payloadcms/storage-s3 (>=3.0.0-beta.29, <=3.0.0-beta.135)

@payloadcms/storage-s3 NPM version =3.0.0-beta.29, =0.1.2, =0.1.0, =0.1.4, =0.1.5 Source cves: CVE-2026-34750 Source advisory: SNYK:JS-PAYLOADCMSSTORAGES3-15873860...

@ainsleydev/payload-helper (0.0.16), @contentql/core (>=0.1.2, <=0.3.5) +2 more potentially affected by CVE-2026-34750 via @payloadcms/storage-s3 (>=3.0.0-beta.29, <=3.0.0-beta.135)

@payloadcms/storage-s3 NPM version =3.0.0-beta.29, =0.1.2, =0.1.0, =0.1.4, =0.1.5 Source cves: CVE-2026-34750 Source advisory: OSV:GHSA-FRQ9-7J6G-V74X...

@01.software/sdk (>=0.0.1-251022.145258, <=0.2.3), @adenta/cms (>=0.0.6, <=1.1.1-0) +71 more potentially affected by CVE-2026-34748 via @payloadcms/ui (>=3.0.0, <=3.77.0-internal.9837b1e)

@payloadcms/ui NPM version =3.0.0, =0.0.1-251022.145258, =0.0.6, =3.70.0, =0.0.3, =3.39.2, =1.0.1-beta.3, =0.1.2, =0.0.1, =1.0.0, =0.1.0, =0.1.2, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-34748 Source advisory: SNYK:JS-PAYLOADCMSUI-15873862...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +16 more potentially affected by CVE-2026-34748 via @payloadcms/next (>=3.0.0-beta.48, <=3.77.0-internal.9837b1e)

@payloadcms/next NPM version =3.0.0-beta.48, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.2.0, =0.2.0, =1.0.54, =0.1.0, =0.1.4, =1.0.0, =0.0.9-alpha.5, =3.0.0-beta.3, =1.53.40, =1.53.45 and more Source cves: CVE-2026-34748 Source advisory: OSV:GHSA-MMXC-95CH-2J7C...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.3.2) +24 more potentially affected by CVE-2026-34747 via @payloadcms/drizzle (>=3.0.0, <=3.79.0-internal.2874f3f)

@payloadcms/drizzle NPM version =3.0.0, =0.0.6, =0.0.6, =3.22.1, =3.37.0, =1.0.0, =3.53.0, =3.61.1-2, =3.50.0-internal.ca62628, =3.0.0-beta.74, =3.0.0-beta.74, =3.0.0-beta.116, =1.0.1, =1.0.2 and more Source cves: CVE-2026-34747 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-15873854...

CVE-2026-34748

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting XSS vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another...

CVE-2026-34748

Summary: CVE-2026-34748 affects the Payload CMS project, specifically the @payloadcms/next package. A stored XSS vulnerability existed in the admin panel prior to version 3.78.0, exploitable by an authenticated user with write access to a collection who saves content that would execute in another...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +20 more potentially affected by CVE-2026-34751 via @payloadcms/graphql (>=3.0.0, <=3.79.0-internal.2874f3f)

@payloadcms/graphql NPM version =3.0.0, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.54, =1.0.1, =0.1.0, =0.1.4, =0.1.5 and more Source cves: CVE-2026-34751 Source advisory: OSV:GHSA-HP5W-3HXX-VMWF...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +20 more potentially affected by CVE-2026-34751 via @payloadcms/graphql (>=3.0.0, <=3.79.0-internal.2874f3f)

@payloadcms/graphql NPM version =3.0.0, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.54, =1.0.1, =0.1.0, =0.1.4, =0.1.5 and more Source cves: CVE-2026-34751 Source advisory: SNYK:JS-PAYLOADCMSGRAPHQL-15871107...

CVE-2026-34750: Improper Limitation of a Pathname to a Restricted Directory

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize...

CVE-2026-34751: External Control of Assumed-Immutable Web Parameter

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue...

CVE-2026-34748: Improper Neutralization of Input During Web Page Generation

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting XSS vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another...

@ainsleydev/payload-helper (>=0.0.6, <=0.1.2), @davincicoding/payload-plugin-kit (0.0.4) +9 more potentially affected by CVE-2026-25544 via @payloadcms/db-sqlite (>=3.0.0-beta.116, <=3.72.0)

@payloadcms/db-sqlite NPM version =3.0.0-beta.116, =0.0.6, =1.1.10, =1.2.0 - payload-smart-deletion 1.0.7 - simple-shop 1.0.0 Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDBSQLITE-15240188...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.1.2) +23 more potentially affected by CVE-2026-25544 via @payloadcms/drizzle (>=3.0.0, <=3.72.0-internal.3e70d4c)

@payloadcms/drizzle NPM version =3.0.0, =0.0.6, =0.0.6, =3.22.1, =3.37.0, =1.0.0, =3.53.0, =3.61.1-2, =3.50.0-internal.ca62628, =3.0.0-beta.74, =3.0.0-beta.74, =3.0.0-beta.116, =1.0.1, =1.0.2 and more Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-15240185...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +16 more potentially affected by CVE-2026-25544 via @payloadcms/next (>=3.0.0-beta.48, <=3.72.0-internal.3e70d4c)

@payloadcms/next NPM version =3.0.0-beta.48, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.2.0, =0.2.0, =1.0.54, =0.1.0, =0.1.4, =1.0.0, =0.0.9-alpha.5, =3.0.0-beta.3, =1.53.40, =1.53.45 and more Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSNEXT-15240192...

SQL Injection

Overview @payloadcms/db-vercel-postgres is a Vercel Postgres adapter for Payload Affected versions of this package are vulnerable to SQL Injection when querying JSON or richText fields. An attacker can extract sensitive information and gain unauthorized access to user accounts by injecting crafte...

@adenta/cms (>=0.0.6, <=1.1.1-0), @lafllamme/personal-page-shared (>=1.0.0, <=1.2.0) +3 more potentially affected by CVE-2026-25544 via @payloadcms/db-postgres (>=3.0.0-beta.135, <=3.61.0)

@payloadcms/db-postgres NPM version =3.0.0-beta.135, =0.0.6, =1.0.0, =0.0.9-alpha.5, =0.0.9-alpha.58 - payload-auth-plugin 0.7.5 Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDBPOSTGRES-15240187...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.1.2) +23 more potentially affected by CVE-2026-25544 via @payloadcms/drizzle (>=3.0.0, <=3.72.0-internal.3e70d4c)

@payloadcms/drizzle NPM version =3.0.0, =0.0.6, =0.0.6, =3.22.1, =3.37.0, =1.0.0, =3.53.0, =3.61.1-2, =3.50.0-internal.ca62628, =3.0.0-beta.74, =3.0.0-beta.74, =3.0.0-beta.116, =1.0.1, =1.0.2 and more Source cves: CVE-2026-25544 Source advisory: OSV:GHSA-XX6W-JXG9-2WH8...

EUVD-2022-1851

Malicious code in bioql PyPI...

@contentql/core (>=0.1.2, <=0.3.5), @launchthat.apps/payload-shadcn (>=0.1.0, <=0.1.8) +12 more potentially affected by CVE-2025-4644 via @payloadcms/graphql (>=3.0.0, <=3.43.0-internal.693bd81)

@payloadcms/graphql NPM version =3.0.0, =0.1.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.1, =0.1.0, =0.1.4, =1.0.0, =0.0.9-alpha.5, =3.0.0-beta.3, =0.0.3, =0.2.0, =0.2.42 Source cves: CVE-2025-4644 Source advisory: OSV:GHSA-26RV-H2HF-3FW4...