CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 09:00 UTC )
This week: 5,436 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,436 Show in the list Critical, last 7 days 355 Show in the list Healthcare-tagged, last 7 days 4 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product payloadcms:payload . Show all products
39 CVEs, showing 1 to 39
CVE Severity Title Published CVE-2026-25544 Critical 9.8 Payload is a free and open source headless content management system. Feb 6, 2026 CVE-2026-25574 Medium 5.4 Payload is a free and open source headless content management system. Feb 6, 2026 CVE-2026-27567 Medium 4.8 Payload is a free and open source headless content management system. Feb 24, 2026 CVE-2026-34751 Critical 9.1 Payload is a free and open source headless content management system. Apr 1, 2026 CVE-2026-34746 High 7.7 Payload is a free and open source headless content management system. Apr 1, 2026 CVE-2026-34747 High 8.2 Payload is a free and open source headless content management system. Apr 1, 2026 CVE-2026-34748 High 8.7 Payload is a free and open source headless content management system. Apr 1, 2026 CVE-2026-34749 Medium 5.4 Payload is a free and open source headless content management system. Apr 1, 2026 CVE-2026-34750 Medium 6.5 Payload is a free and open source headless content management system. Apr 1, 2026 CVE-2026-93363 Medium 4.3 Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route Assigned by VulnCheck
Sep 25, 2026 CVE-2026-105804 Medium 5.7 Payload: Password hashes use insufficient PBKDF2 iterations Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105805 Medium 6.9 Payload: Sort queries could expose protected field information Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105806 High 8.6 Payload: Improper access control for MCP API keys Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105844 Critical 9.3 Payload: Prototype pollution in Payload Import Export plugin Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105845 Critical 9.8 Payload: SQL Injection in SQLite and Postgres Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105846 Medium 6.1 Payload: Untrusted redirect URL parameter exploit Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105847 High 7.1 Payload: Polymorphic join queries could disclose hidden fields Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105848 Medium 6.4 Payload: Insufficient Access Control in Stripe REST Proxy Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105849 High 7.7 Payload: API key disclosure through ordinary document reads Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105850 High 8.8 Payload: Order confirmation validation issue in Payload Ecommerce Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105851 Critical 9.3 Payload: Field access control bypass on auth collections Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105852 Medium 6.9 Payload relationship-query authorization bypass Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105853 High 7.1 Payload: Token refresh and password reset responses may expose restricted user fields Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105854 High 8.7 Payload: ReDoS in Multipart Content-Type Validation Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105855 High 7.6 Payload: Field-level password update restrictions were not enforced Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105856 High 8.6 Payload: SQL injection in SQLite/Postgres Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105857 Critical 10.0 Payload: RCE in Payload Form Builder Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105858 High 8.1 Payload: Remote Code Execution through first-register Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105859 Critical 9.8 Payload: Unauthorized update to collection documents Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105860 High 7.1 Payload: Tenant authorization bypass in Multi-Tenant Plugin Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105861 High 7.2 Payload external upload trust validation issue Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105862 High 8.7 Payload: Bypassed sanitization of user uploaded SVGs Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105863 Critical 9.2 Payload authentication token field handling issue Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105864 Medium 5.3 Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105865 High 8.1 Payload: Incomplete validation during the upload file lifecycle Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105866 Medium 6.9 Payload: Unauthenticated account-lockout denial of service Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105867 High 7.1 Payload: Client uploads could overwrite S3 objects Assigned by GitHub_M
Oct 6, 2026 CVE-2026-105868 High 8.6 Payload: Uploaded XML files could execute same-origin JavaScript Assigned by GitHub_M
Oct 6, 2026 CVE-2026-106100 High 7.1 Payload: Field-level write access bypass in Payload on MongoDB Assigned by GitHub_M
Oct 6, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
