EUVD-2026-87206

@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter...

GHSA-MC8M-RR6C-R5QR @payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter

Impact In affected configurations, client upload access does not consistently align with the associated collection’s access configuration. You are affected if: - You use client uploads with @payloadcms/storage-vercel-blob. - Authenticated users can access the client-upload route. Applications tha...

@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter

Impact In affected configurations, client upload access does not consistently align with the associated collection’s access configuration. You are affected if: - You use client uploads with @payloadcms/storage-vercel-blob. - Authenticated users can access the client-upload route. Applications tha...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated...

@basildesignco/payload-preset (0.1.0), @frogbotai/storage-vercel-blob (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-105862 via @payloadcms/storage-vercel-blob (>=3.85.1, <=3.89.0)

@payloadcms/storage-vercel-blob NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-105862 Source advisory: SNYK:JS-PAYLOADCMSSTORAGEVERCELBLOB-20570518...

Arbitrary File Upload

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData an...

@basildesignco/payload-preset (0.1.0), @frogbotai/storage-vercel-blob (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-105868 via @payloadcms/storage-vercel-blob (>=3.85.1, <=3.89.0)

@payloadcms/storage-vercel-blob NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-105868 Source advisory: SNYK:JS-PAYLOADCMSSTORAGEVERCELBLOB-20570544...

@basildesignco/payload-preset (0.1.0), @frogbotai/storage-vercel-blob (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-93363 via @payloadcms/storage-vercel-blob (>=3.85.1, <=3.89.0)

@payloadcms/storage-vercel-blob NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-93363 Source advisory: SNYK:JS-PAYLOADCMSSTORAGEVERCELBLOB-20158638...

Missing Authorization

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Missing Authorization in the getClientUploadRoute handler for the client-upload path. An attacker can upload files by sending a client upload request t...

CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

@basildesignco/payload-preset (0.1.0), @frogbotai/storage-vercel-blob (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-93363 via @payloadcms/storage-vercel-blob (>=3.85.1, <=3.89.0)

@payloadcms/storage-vercel-blob NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-93363 Source advisory: MEND:CVE-2026-93363...

CVE-2026-93363 Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

CVE-2026-93363 Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

CVE-2026-93363 Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability. Authenticated users can bypass collection-level permissions by directly accessing the client-upload route , allowing them to upload files without the required permissions and circumv...

CVE-2026-93363: Missing Authorization

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

PT-2026-98951

Name of the Vulnerable Software and Affected Versions @payloadcms/storage-vercel-blob affected versions not specified Description Improper access control in the storage adapter allows authenticated users to bypass collection-level permissions. By directly accessing the 'client-upload' endpoint,...

Malicious code in electron-sessions (npm)

Source: amazon-inspector cb868700350bb9700f3419a058a7802293ac0e39212ecd0c9f16eddb9e0af769 Package published as electron-sessions advertises itself as generic 'Session utilities' but ships a single 1.18MB heavily obfuscated dist/index.js javascript-obfuscator with rotating string-array of length...

Malicious code in electron-sessions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb868700350bb9700f3419a058a7802293ac0e39212ecd0c9f16eddb9e0af769 Package published as electron-sessions advertises itself as generic 'Session utilities' but ships a single 1.18MB heavily obfuscated dist/index.js...