payload vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-105858Highpayload: Payload: Remote Code Execution through first-register CVE-2026-105861Highpayload: Payload external upload trust validation issue CVE-2026-105862Highpayload: Payload: Bypassed sanitization of user uploaded SVGs CVE-2026-105865Highpayload: Payload: Incomplete validation during the upload file lifecycle CVE-2026-105866Mediumpayload: Payload: Unauthenticated account-lockout denial of service CVE-2026-105868Highpayload: Payload: Uploaded XML files could execute same-origin JavaScript CVE-2026-105859Criticalpayload: Payload: Unauthorized update to collection documents CVE-2026-105863Criticalpayload: Payload authentication token field handling issue CVE-2026-105855Highpayload: Payload didn't enforce field-level password update restrictions CVE-2026-105854Highpayload: Payload: ReDoS in Multipart Content-Type Validation CVE-2026-105849Highpayload: Payload vulnerable to API key disclosure through ordinary document reads CVE-2026-105852Mediumpayload: Payload relationship-query authorization bypass CVE-2026-105853Highpayload: Payload: Token refresh and password reset responses may expose restricted user fields CVE-2026-105851Criticalpayload: Payload: Field access control bypass on auth collections CVE-2026-105845Criticalpayload: Payload: SQL Injection in SQLite and Postgres CVE-2026-105846Mediumpayload: Payload: Untrusted redirect URL parameter exploit CVE-2026-105847Highpayload: Payload: Polymorphic join queries could disclose hidden fields CVE-2026-105804Mediumpayload: Payload: Password hashes use insufficient PBKDF2 iterations CVE-2026-105805Mediumpayload: Payload: Sort queries could expose protected field information CVE-2026-11779Mediumpayload: Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts CVE-2026-34749Mediumpayload: Payload has a CSRF Protection Bypass in Authentication Flow CVE-2026-34746Highpayload: Payload has Authenticated SSRF via Upload Functionality CVE-2026-34747Highpayload: Payload has an SQL Injection via Query Handling CVE-2026-34751Criticalpayload: Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery CVE-2026-27567Mediumpayload: Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo