CVE-20XX-?

Payloadcms Payload CVEs.

Published CVEs affecting Payloadcms Payload, ranked by exploit odds.

1 CVEs · updated 2026-11-06 03:33 UTC

Reset all
  1. CVE-2026-105868

    Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

    Code execution Payloadcms Payload

    8.6 HIGH 0.2% exploit odds Fix listed

All CVEs affecting Payloadcms Payload that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.