CVE-2026-34751

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +19 more potentially affected by CVE-2026-34751 via @payloadcms/graphql (>=3.0.0-alpha.0, <=3.79.0)

@payloadcms/graphql NPM version =3.0.0-alpha.0, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.54, =1.0.1, =0.1.0, =0.1.4, =0.1.5 and more Source cves: CVE-2026-34751 Source advisory: MEND:CVE-2026-34751...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +19 more potentially affected by CVE-2026-34751 via @payloadcms/graphql (>=3.0.0-alpha.0, <=3.79.0)

@payloadcms/graphql NPM version =3.0.0-alpha.0, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.54, =1.0.1, =0.1.0, =0.1.4, =0.1.5 and more Source cves: CVE-2026-34751 Source advisory: OSV:GHSA-HP5W-3HXX-VMWF...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +19 more potentially affected by CVE-2026-34751 via @payloadcms/graphql (>=3.0.0-alpha.0, <=3.79.0)

@payloadcms/graphql NPM version =3.0.0-alpha.0, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.54, =1.0.1, =0.1.0, =0.1.4, =0.1.5 and more Source cves: CVE-2026-34751 Source advisory: SNYK:JS-PAYLOADCMSGRAPHQL-15871107...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +19 more potentially affected by CVE-2026-34751 via @payloadcms/graphql (>=3.0.0-alpha.0, <=3.79.0)

@payloadcms/graphql NPM version =3.0.0-alpha.0, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.54, =1.0.1, =0.1.0, =0.1.4, =0.1.5 and more Source cves: CVE-2026-34751 Source advisory: GHSA-HP5W-3HXX-VMWF...

CVE-2026-34750: Improper Limitation of a Pathname to a Restricted Directory

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize...

CVE-2026-34748: Improper Neutralization of Input During Web Page Generation

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting XSS vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another...

CVE-2026-34751: External Control of Assumed-Immutable Web Parameter

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.1.2) +22 more potentially affected by CVE-2026-25544 via @payloadcms/drizzle (>=3.0.0-beta.74, <=3.73.0-internal.ff401d9)

@payloadcms/drizzle NPM version =3.0.0-beta.74, =0.0.6, =0.0.6, =3.22.1, =3.37.0, =1.0.0, =3.53.0, =3.61.1-2, =3.50.0-internal.ca62628, =3.0.0-beta.74, =3.0.0-beta.74, =3.0.0-beta.116, =1.0.1, =1.0.2 and more Source cves: CVE-2026-25544 Source advisory: MEND:CVE-2026-25544...

@ainsleydev/payload-helper (>=0.0.6, <=0.1.2), @davincicoding/payload-plugin-kit (0.0.4) +9 more potentially affected by CVE-2026-25544 via @payloadcms/db-sqlite (>=3.0.0-beta.116, <=3.72.0)

@payloadcms/db-sqlite NPM version =3.0.0-beta.116, =0.0.6, =1.1.10, =1.2.0 - payload-smart-deletion 1.0.7 - simple-shop 1.0.0 Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDBSQLITE-15240188...

SQL Injection

Overview @payloadcms/db-vercel-postgres is a Vercel Postgres adapter for Payload Affected versions of this package are vulnerable to SQL Injection when querying JSON or richText fields. An attacker can extract sensitive information and gain unauthorized access to user accounts by injecting crafte...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.1.2) +22 more potentially affected by CVE-2026-25544 via @payloadcms/drizzle (>=3.0.0-beta.74, <=3.73.0-internal.ff401d9)

@payloadcms/drizzle NPM version =3.0.0-beta.74, =0.0.6, =0.0.6, =3.22.1, =3.37.0, =1.0.0, =3.53.0, =3.61.1-2, =3.50.0-internal.ca62628, =3.0.0-beta.74, =3.0.0-beta.74, =3.0.0-beta.116, =1.0.1, =1.0.2 and more Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-15240185...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.1.2) +22 more potentially affected by CVE-2026-25544 via @payloadcms/drizzle (>=3.0.0-beta.74, <=3.73.0-internal.ff401d9)

@payloadcms/drizzle NPM version =3.0.0-beta.74, =0.0.6, =0.0.6, =3.22.1, =3.37.0, =1.0.0, =3.53.0, =3.61.1-2, =3.50.0-internal.ca62628, =3.0.0-beta.74, =3.0.0-beta.74, =3.0.0-beta.116, =1.0.1, =1.0.2 and more Source cves: CVE-2026-25544 Source advisory: GHSA-XX6W-JXG9-2WH8...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +15 more potentially affected by CVE-2026-25544 via @payloadcms/next (>=3.0.0-beta.48, <=3.73.0-internal.ff401d9)

@payloadcms/next NPM version =3.0.0-beta.48, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.2.0, =0.2.0, =1.0.54, =0.1.0, =0.1.4, =1.0.0, =3.0.0-beta.3, =1.53.40, =0.0.3, =1.0.0 and more Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSNEXT-15240192...

@adenta/cms (>=0.0.6, <=1.1.1-0), @lafllamme/personal-page-shared (>=1.0.0, <=1.2.0) +2 more potentially affected by CVE-2026-25544 via @payloadcms/db-postgres (>=3.46.0, <=3.61.0)

@payloadcms/db-postgres NPM version =3.46.0, =0.0.6, =1.0.0, =1.2.0 - @otherdev-software/canvas 1.0.0 - payload-auth-plugin 0.7.5 Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDBPOSTGRES-15240187...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.1.2) +22 more potentially affected by CVE-2026-25544 via @payloadcms/drizzle (>=3.0.0-beta.74, <=3.73.0-internal.ff401d9)

@payloadcms/drizzle NPM version =3.0.0-beta.74, =0.0.6, =0.0.6, =3.22.1, =3.37.0, =1.0.0, =3.53.0, =3.61.1-2, =3.50.0-internal.ca62628, =3.0.0-beta.74, =3.0.0-beta.74, =3.0.0-beta.116, =1.0.1, =1.0.2 and more Source cves: CVE-2026-25544 Source advisory: OSV:GHSA-XX6W-JXG9-2WH8...

EUVD-2022-1851

Malicious code in bioql PyPI...

@contentql/core (>=0.1.2, <=0.3.5), @launchthat.apps/payload-shadcn (>=0.1.0, <=0.1.8) +11 more potentially affected by CVE-2025-4644 via @payloadcms/graphql (>=3.0.0-alpha.0, <=3.44.0-internal.6b79dc2)

@payloadcms/graphql NPM version =3.0.0-alpha.0, =0.1.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.1, =0.1.0, =0.1.4, =1.0.0, =3.0.0-beta.3, =0.0.3, =0.2.0, =0.2.42 Source cves: CVE-2025-4644 Source advisory: OSV:GHSA-26RV-H2HF-3FW4...

@contentql/core (>=0.1.2, <=0.3.5), @launchthat.apps/payload-shadcn (>=0.1.0, <=0.1.8) +11 more potentially affected by CVE-2025-4643 via @payloadcms/graphql (>=3.0.0-alpha.0, <=3.44.0-internal.6b79dc2)

@payloadcms/graphql NPM version =3.0.0-alpha.0, =0.1.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.1, =0.1.0, =0.1.4, =1.0.0, =3.0.0-beta.3, =0.0.3, =0.2.0, =0.2.42 Source cves: CVE-2025-4643 Source advisory: OSV:GHSA-5V66-M237-HWF7...

@contentql/core (>=0.1.2, <=0.3.5), @launchthat.apps/payload-shadcn (>=0.1.0, <=0.1.8) +11 more potentially affected by CVE-2025-4644 via @payloadcms/graphql (>=3.0.0-alpha.0, <=3.44.0-internal.6b79dc2)

@payloadcms/graphql NPM version =3.0.0-alpha.0, =0.1.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.1, =0.1.0, =0.1.4, =1.0.0, =3.0.0-beta.3, =0.0.3, =0.2.0, =0.2.42 Source cves: CVE-2025-4644 Source advisory: GHSA-26RV-H2HF-3FW4...