Homepage

Find out if you have vulnerabilities that put you at risk

Test your applications
Toggle filtering controls
Report a new vulnerability
  • M
Use of Password Hash With Insufficient Computational EffortCVE-2026-105804
Affects payload | Versions >=3.0.0 <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • H
Regular Expression Denial of Service (ReDoS)CVE-2026-105854
Affects payload | Versions >=3.0.0 <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • H
Improper AuthorizationCVE-2026-105853
Affects payload | Versions >=3.0.0 <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • H
Missing AuthorizationCVE-2026-105849
Affects @payloadcms/ui | Versions >=3.0.0 <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • H
Missing AuthorizationCVE-2026-105849
Affects payload | Versions >=3.0.0 <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • C
Incorrect AuthorizationCVE-2026-105851
Affects payload | Versions >=3.0.0 <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • H
Authorization Bypass Through User-Controlled KeyCVE-2026-105847
Affects payload | Versions >=3.0.0 <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • M
Missing AuthorizationCVE-2026-105852
Affects @payloadcms/drizzle | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • M
Missing AuthorizationCVE-2026-105852
Affects @payloadcms/db-mongodb | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • M
Missing AuthorizationCVE-2026-105852
Affects payload | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • C
Missing AuthorizationCVE-2026-105859
Affects payload | Versions >=3.32.0 <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • C
Partial String ComparisonCVE-2026-105858
Affects @payloadcms/next | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • H
External Control of File Name or PathCVE-2026-105865
Affects payload | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • H
Arbitrary File UploadCVE-2026-105868
Affects @payloadcms/storage-vercel-blob | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • H
Arbitrary File UploadCVE-2026-105868
Affects @payloadcms/storage-s3 | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • H
Arbitrary File UploadCVE-2026-105868
Affects @payloadcms/storage-uploadthing | Versions <3.90.0>=4.0.0-canary.0
Has fix
npmPublished 8 Oct 2026
  • H
Arbitrary File UploadCVE-2026-105868
Affects @payloadcms/storage-gcs | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • H
Arbitrary File UploadCVE-2026-105868
Affects @payloadcms/storage-azure | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • H
Arbitrary File UploadCVE-2026-105868
Affects @payloadcms/payload-cloud | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • H
Arbitrary File UploadCVE-2026-105868
Affects payload | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • H
Origin Validation ErrorCVE-2026-105861
Affects payload | Versions >=3.0.0 <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • C
Improperly Controlled Modification of Dynamically-Determined Object AttributesCVE-2026-105863
Affects payload | Versions >=3.0.0 <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • C
Cross-site Scripting (XSS)CVE-2026-105862
Affects @payloadcms/storage-uploadthing | Versions <3.90.0>=4.0.0-canary.0
Has fix
npmPublished 8 Oct 2026
  • C
Cross-site Scripting (XSS)CVE-2026-105862
Affects @payloadcms/storage-s3 | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • C
Cross-site Scripting (XSS)CVE-2026-105862
Affects @payloadcms/storage-gcs | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • C
Cross-site Scripting (XSS)CVE-2026-105862
Affects @payloadcms/storage-azure | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • C
Cross-site Scripting (XSS)CVE-2026-105862
Affects @payloadcms/payload-cloud | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • C
Cross-site Scripting (XSS)CVE-2026-105862
Affects @payloadcms/storage-vercel-blob | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • C
Cross-site Scripting (XSS)CVE-2026-105862
Affects payload | Versions <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
Has fix
npmPublished 8 Oct 2026
  • M
Prototype PollutionCVE-2026-107353
Affects traverse | Versions >=0.6.0 <0.6.12>=0.5.0 <0.5.3>=0.4.0 <0.4.7>=0.3.6 <0.3.10
Has fix
npmPublished 8 Oct 2026