Skip to content
Threat Feed
Subscribe

Tag

Payloadcms

3 briefs RSS
critical advisory

Remote Code Execution in @payloadcms/plugin-form-builder

A critical remote code execution vulnerability (CVE-2026-105857) in @payloadcms/plugin-form-builder allows unauthenticated attackers to execute arbitrary code via crafted form submissions.

@payloadcms/plugin-form-builder remote-code-execution web-application-vulnerability payloadcms
1c
medium advisory

Payload CMS Stored XSS Vulnerability (CVE-2026-34748)

A stored Cross-Site Scripting (XSS) vulnerability exists in Payload CMS versions prior to 3.78.0, allowing authenticated users with write access to inject malicious scripts that execute in the browsers of other users.

xss cve-2026-34748 payloadcms
2r 1t 1c
critical advisory

PayloadCMS Puck Plugin Access Control Bypass Vulnerability

A critical vulnerability in @delmaredigital/payload-puck versions prior to 0.6.23 allows attackers to bypass collection-level access controls in PayloadCMS via the /api/puck/* endpoints due to improper access configuration, leading to unauthorized data manipulation.

payload-puck plugin +1 payloadcms puck access-control-bypass cve-2026-39397
2r 1t 1c