Skip to content

cveboard RSS feed

payloadcms

Wednesday, October 7
- GitHub CVE-2026-105857
  Payload Form Builder has an RCE issue
  - payloadcms payload
  - Critical
  - CVSS 10.0
  - EPSS 0.43%
  - Fixed version listed
  20:28 UTC
- GitHub CVE-2026-105859
  Payload: Unauthorized update to collection documents
  - payloadcms payload
  - Critical
  - CVSS 9.8
  - EPSS 0.35%
  - Fixed version listed
  20:28 UTC
- GitHub CVE-2026-105863
  Payload authentication token field handling issue
  - payloadcms payload
  - Critical
  - CVSS 9.2
  - EPSS 0.38%
  - Fixed version listed
  20:28 UTC
Tuesday, October 6
- GitHub CVE-2026-105845
  Payload: SQL Injection in SQLite and Postgres
  - payloadcms payload
  - Critical
  - CVSS 9.8
  - EPSS 0.38%
  - Fixed version listed
  16:09 UTC
- GitHub CVE-2026-105851
  Payload: Field access control bypass on auth collections
  - payloadcms payload
  - Critical
  - CVSS 9.3
  - EPSS 0.25%
  - Fixed version listed
  16:17 UTC
- GitHub CVE-2026-105844
  Payload: Prototype pollution in Payload Import Export plugin
  - payloadcms payload
  - Critical
  - CVSS 9.3
  - EPSS 0.52%
  - Fixed version listed
  16:09 UTC