Vulnerabilities in @payloadcms
8 resultsCVE-2026-105844CRITICALPayload: Prototype pollution in Payload Import Export pluginEPSS 0.5%CVE-2026-105850HIGHPayload: Order confirmation validation issue in Payload EcommerceEPSS 0.3%CVE-2026-105856HIGHPayload: SQL injection in SQLite/PostgresEPSS 0.3%CVE-2026-105867HIGHPayload: Client uploads could overwrite S3 objectsEPSS 0.3%CVE-2026-105864MEDIUMPayload: Cross-tenant create in @payloadcms/plugin-multi-tenantEPSS 0.3%CVE-2026-105806HIGHPayload: Improper access control for MCP API keysEPSS 0.3%CVE-2026-105848MEDIUMPayload: Insufficient Access Control in Stripe REST ProxyEPSS 0.3%CVE-2026-105846MEDIUMPayload: Untrusted redirect URL parameter exploitEPSS 0.2%