CVE-2026-34751: External Control of Assumed-Immutable Web Parameter

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue...

CVE-2026-34748: Improper Neutralization of Input During Web Page Generation

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting XSS vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.1.2) +23 more potentially affected by CVE-2026-25544 via @payloadcms/drizzle (>=3.0.0, <=3.72.0-internal.3e70d4c)

@payloadcms/drizzle NPM version =3.0.0, =0.0.6, =0.0.6, =3.22.1, =3.37.0, =1.0.0, =3.53.0, =3.61.1-2, =3.50.0-internal.ca62628, =3.0.0-beta.74, =3.0.0-beta.74, =3.0.0-beta.116, =1.0.1, =1.0.2 and more Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-15240185...

@ainsleydev/payload-helper (>=0.0.6, <=0.1.2), @davincicoding/payload-plugin-kit (0.0.4) +9 more potentially affected by CVE-2026-25544 via @payloadcms/db-sqlite (>=3.0.0-beta.116, <=3.72.0)

@payloadcms/db-sqlite NPM version =3.0.0-beta.116, =0.0.6, =1.1.10, =1.2.0 - payload-smart-deletion 1.0.7 - simple-shop 1.0.0 Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDBSQLITE-15240188...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +16 more potentially affected by CVE-2026-25544 via @payloadcms/next (>=3.0.0-beta.48, <=3.72.0-internal.3e70d4c)

@payloadcms/next NPM version =3.0.0-beta.48, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.2.0, =0.2.0, =1.0.54, =0.1.0, =0.1.4, =1.0.0, =0.0.9-alpha.5, =3.0.0-beta.3, =1.53.40, =1.53.45 and more Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSNEXT-15240192...

SQL Injection

Overview @payloadcms/db-vercel-postgres is a Vercel Postgres adapter for Payload Affected versions of this package are vulnerable to SQL Injection when querying JSON or richText fields. An attacker can extract sensitive information and gain unauthorized access to user accounts by injecting crafte...

@adenta/cms (>=0.0.6, <=1.1.1-0), @lafllamme/personal-page-shared (>=1.0.0, <=1.2.0) +3 more potentially affected by CVE-2026-25544 via @payloadcms/db-postgres (>=3.0.0-beta.135, <=3.61.0)

@payloadcms/db-postgres NPM version =3.0.0-beta.135, =0.0.6, =1.0.0, =0.0.9-alpha.5, =0.0.9-alpha.58 - payload-auth-plugin 0.7.5 Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDBPOSTGRES-15240187...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.1.2) +23 more potentially affected by CVE-2026-25544 via @payloadcms/drizzle (>=3.0.0, <=3.72.0-internal.3e70d4c)

@payloadcms/drizzle NPM version =3.0.0, =0.0.6, =0.0.6, =3.22.1, =3.37.0, =1.0.0, =3.53.0, =3.61.1-2, =3.50.0-internal.ca62628, =3.0.0-beta.74, =3.0.0-beta.74, =3.0.0-beta.116, =1.0.1, =1.0.2 and more Source cves: CVE-2026-25544 Source advisory: OSV:GHSA-XX6W-JXG9-2WH8...

EUVD-2022-1851

Malicious code in bioql PyPI...

@contentql/core (>=0.1.2, <=0.3.5), @launchthat.apps/payload-shadcn (>=0.1.0, <=0.1.8) +12 more potentially affected by CVE-2025-4644 via @payloadcms/graphql (>=3.0.0, <=3.43.0-internal.693bd81)

@payloadcms/graphql NPM version =3.0.0, =0.1.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.1, =0.1.0, =0.1.4, =1.0.0, =0.0.9-alpha.5, =3.0.0-beta.3, =0.0.3, =0.2.0, =0.2.42 Source cves: CVE-2025-4644 Source advisory: OSV:GHSA-26RV-H2HF-3FW4...

@contentql/core (>=0.1.2, <=0.3.5), @launchthat.apps/payload-shadcn (>=0.1.0, <=0.1.8) +12 more potentially affected by CVE-2025-4643 via @payloadcms/graphql (>=3.0.0, <=3.43.0-internal.693bd81)

@payloadcms/graphql NPM version =3.0.0, =0.1.2, =0.1.0, =3.0.0-alpha.0, =3.2.0, =0.2.0, =3.0.0-beta.10, =1.0.1, =0.1.0, =0.1.4, =1.0.0, =0.0.9-alpha.5, =3.0.0-beta.3, =0.0.3, =0.2.0, =0.2.42 Source cves: CVE-2025-4643 Source advisory: OSV:GHSA-5V66-M237-HWF7...

@contentql/core (>=0.1.2, <=0.3.5), @launchthat.apps/payload-shadcn (>=0.1.0, <=0.1.8) +9 more potentially affected by CVE-2025-4644 via @payloadcms/next (>=3.0.0-beta.48, <=3.43.0-internal.693bd81)

@payloadcms/next NPM version =3.0.0-beta.48, =0.1.2, =0.1.0, =3.2.0, =0.2.0, =0.1.0, =0.1.4, =1.0.0, =0.0.9-alpha.5, =3.0.0-beta.3, =0.0.3, =0.2.0, =0.2.42 Source cves: CVE-2025-4644 Source advisory: OSV:GHSA-26RV-H2HF-3FW4...

CVE-2025-4644 User Session Fixation after Account Removal in PayloadCMS

A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token JWT, and then delete the account, which did not invalidate the JWT. As a result, the next newly created us...

CVE-2025-4644 User Session Fixation after Account Removal in PayloadCMS

A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token JWT, and then delete the account, which did not invalidate the JWT. As a result, the next newly created us...

CVE-2025-4643 Lack of JWT Expiration after Log Out in PayloadCMS

Payload uses JSON Web Tokens JWT for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date which is by default set to 2 hours, but can be changed. This issue has been fixed in version 3.44.0 of...

CVE-2022-27952

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file...

PayloadCMS arbitrary file upload vulnerability

PayloadCMS is a Headless CMS and application framework built using TypeScript, Node.js, React and MongoDB.PayloadCMS is vulnerable to arbitrary file uploads, which can be exploited by attackers to execute arbitrary code via crafted SVG files...

GHSA-W8XH-93QH-35VW Unrestricted Upload of File with Dangerous Type in Payload

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-27952

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-27952

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file...