268229 matches found
@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105862 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)
payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105862 Source advisory: OSV:GHSA-2PWP-2369-8FG3...
@otherdev-software/canvas (1.0.0), payload-stack (>=0.2.0, <=0.3.0) potentially affected by CVE-2026-105864 via @payloadcms/plugin-multi-tenant (>=3.61.0, <=3.88.0)
@payloadcms/plugin-multi-tenant NPM version =3.61.0, =0.2.0, =0.3.0 Source cves: CVE-2026-105864 Source advisory: OSV:GHSA-XHM9-GWGW-3Q2Q...
@otherdev-software/canvas (1.0.0), payload-stack (>=0.2.0, <=0.3.0) potentially affected by CVE-2026-105864 via @payloadcms/plugin-multi-tenant (>=3.61.0, <=3.88.0)
@payloadcms/plugin-multi-tenant NPM version =3.61.0, =0.2.0, =0.3.0 Source cves: CVE-2026-105864 Source advisory: GHSA-XHM9-GWGW-3Q2Q...
@payloadcms/plugin-multi-tenant has a cross-tenant create issue
Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: - You are using...
GHSA-XHM9-GWGW-3Q2Q @payloadcms/plugin-multi-tenant has a cross-tenant create issue
Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: - You are using...
Incorrect Authorization
Overview @payloadcms/plugin-multi-tenant is a Multi Tenant plugin for Payload Affected versions of this package are vulnerable to Incorrect Authorization via the tenantField default value logic in packages/plugin-multi-tenant/src/fields/tenantField/index.ts, where the return value of...
EUVD-2026-93510
@payloadcms/plugin-multi-tenant has a cross-tenant create issue...
@otherdev-software/canvas (1.0.0), payload-stack (>=0.2.0, <=0.3.0) potentially affected by CVE-2026-105864 via @payloadcms/plugin-multi-tenant (>=3.61.0, <=3.88.0)
@payloadcms/plugin-multi-tenant NPM version =3.61.0, =0.2.0, =0.3.0 Source cves: CVE-2026-105864 Source advisory: SNYK:JS-PAYLOADCMSPLUGINMULTITENANT-20883332...
@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105865 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)
payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105865 Source advisory: GHSA-P223-2WR2-J562...
@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105865 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)
payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105865 Source advisory: OSV:GHSA-P223-2WR2-J562...
@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105865 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)
payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105865 Source advisory: SNYK:JS-PAYLOAD-20570545...
@payloadcms/plugin-search (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105866 via @payloadcms/next (>=4.0.0-canary.0, <=4.0.0-canary.33)
@payloadcms/next NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105866 Source advisory: SNYK:JS-PAYLOADCMSNEXT-20570506...
@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105866 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)
payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105866 Source advisory: SNYK:JS-PAYLOAD-20570505...
@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105866 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)
payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105866 Source advisory: OSV:GHSA-V5GF-VPJC-PC7W...
@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105866 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)
payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105866 Source advisory: GHSA-V5GF-VPJC-PC7W...
@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105868 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)
payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105868 Source advisory: OSV:GHSA-9QPG-3CF8-W33X...
@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105868 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)
payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105868 Source advisory: GHSA-9QPG-3CF8-W33X...
EUVD-2026-93501
Payload Form Builder has an RCE issue...
Arbitrary Code Injection
Overview @payloadcms/plugin-form-builder is a Form builder plugin for Payload CMS Affected versions of this package are vulnerable to Arbitrary Code Injection via insufficient access control on the FormSubmissions and Forms collections, where the read access check only verifies that a user is...