CVE-2026-104070

The Crayons plugin for SPIP versions before 3.5.0 is vulnerable to a missing authorization flaw in crayons_store.php. By omitting the secu_ anti-forgery parameter, unauthenticated attackers can bypass modification checks and modify arbitrary editable object fields. This allows attackers to chain ...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105852 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105852 Source advisory: MEND:CVE-2026-105852...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105851 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105851 Source advisory: MEND:CVE-2026-105851...

EUVD-2026-93493

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions...

CVE-2026-105850

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions...

CVE-2026-105850

The Payload headless content management system is vulnerable in @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34 . When using the Stripe payment adapter , certain conditions can cause a Stripe order confirmation to be processed more than once. This is...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105849 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105849 Source advisory: MEND:CVE-2026-105849...

GHSA-R9V2-GG2J-22Q5 Payload: Insufficient Access Control in Stripe REST Proxy

Impact An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy. You are affected if ALL of these are true: - Your application uses @payloadcms/plugin-stripe. - The optional Stripe REST proxy is enabled. - An authenticated user can reach the proxy...

Missing Authorization

Overview @payloadcms/plugin-stripe is a Stripe plugin for Payload Affected versions of this package are vulnerable to Missing Authorization via the Stripe REST proxy endpoint packages/plugin-stripe/src/routes/rest.ts, which previously defaulted to enabled and applied only a logged-in user check...

@frogbotai/plugin-stripe (>=0.14.0, <=0.23.0) potentially affected by CVE-2026-105848 via @payloadcms/plugin-stripe (>=3.85.1, <=3.88.0)

@payloadcms/plugin-stripe NPM version =3.85.1, =0.14.0, =0.23.0 Source cves: CVE-2026-105848 Source advisory: OSV:GHSA-R9V2-GG2J-22Q5...

@frogbotai/plugin-stripe (>=0.14.0, <=0.23.0) potentially affected by CVE-2026-105848 via @payloadcms/plugin-stripe (>=3.85.1, <=3.88.0)

@payloadcms/plugin-stripe NPM version =3.85.1, =0.14.0, =0.23.0 Source cves: CVE-2026-105848 Source advisory: GHSA-R9V2-GG2J-22Q5...

@frogbotai/plugin-stripe (>=0.14.0, <=0.23.0) potentially affected by CVE-2026-105848 via @payloadcms/plugin-stripe (>=3.85.1, <=3.88.0)

@payloadcms/plugin-stripe NPM version =3.85.1, =0.14.0, =0.23.0 Source cves: CVE-2026-105848 Source advisory: SNYK:JS-PAYLOADCMSPLUGINSTRIPE-20936880...

Payload: Insufficient Access Control in Stripe REST Proxy

Impact An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy. You are affected if ALL of these are true: - Your application uses @payloadcms/plugin-stripe. - The optional Stripe REST proxy is enabled. - An authenticated user can reach the proxy...

GHSA-2Q76-M6W6-QGC6 Payload: Improper access control for MCP API keys

Impact Under certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover. Applications that do not use @payloadcms/plugin-mcp are not affected. Patches Users should upgrade to...

Payload: Improper access control for MCP API keys

Impact Under certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover. Applications that do not use @payloadcms/plugin-mcp are not affected. Patches Users should upgrade to...

@frogbotai/plugin-mcp (>=0.14.0, <=0.21.0), @justanarthur/payload-www (>=1.0.1, <=1.4.2) +1 more potentially affected by CVE-2026-105806 via @payloadcms/plugin-mcp (>=3.85.0, <=3.87.1)

@payloadcms/plugin-mcp NPM version =3.85.0, =0.14.0, =1.0.1, =0.6.0, =0.7.0 Source cves: CVE-2026-105806 Source advisory: GHSA-2Q76-M6W6-QGC6...

@frogbotai/plugin-mcp (>=0.14.0, <=0.21.0), @justanarthur/payload-www (>=1.0.1, <=1.4.2) +1 more potentially affected by CVE-2026-105806 via @payloadcms/plugin-mcp (>=3.85.0, <=3.87.1)

@payloadcms/plugin-mcp NPM version =3.85.0, =0.14.0, =1.0.1, =0.6.0, =0.7.0 Source cves: CVE-2026-105806 Source advisory: OSV:GHSA-2Q76-M6W6-QGC6...

@frogbotai/plugin-import-export (>=0.14.0, <=0.21.0) potentially affected by CVE-2026-105844 via @payloadcms/plugin-import-export (3.85.1)

@payloadcms/plugin-import-export NPM version 3.85.1 is affected by a known vulnerability. The following packages have a transitive dependency on @payloadcms/plugin-import-export and may be impacted: - @frogbotai/plugin-import-export =0.14.0, =0.21.0 Source cves: CVE-2026-105844 Source advisory:...

Payload: Prototype pollution in Payload Import Export plugin

Impact An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code RCE. Applications that do not use @payloadcms/plugin-import-export are not affected. Patches Users should upgrade Payload...

@frogbotai/plugin-import-export (>=0.14.0, <=0.21.0) potentially affected by CVE-2026-105844 via @payloadcms/plugin-import-export (3.85.1)

@payloadcms/plugin-import-export NPM version 3.85.1 is affected by a known vulnerability. The following packages have a transitive dependency on @payloadcms/plugin-import-export and may be impacted: - @frogbotai/plugin-import-export =0.14.0, =0.21.0 Source cves: CVE-2026-105844 Source advisory:...