payloadcms payload

Name: payloadcms payload
Brand: payloadcms

productUS

cpe:2.3:a:payloadcms:payload:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

3critical12high6medium0low

updated 2026-10-27

vulnerabilities (35)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-25544US	—	0.84% (58th)	Exploit	3.73.0	2026-02-06	< 3.73.0
CVE-2022-27952US	critical9.8	2.31% (83rd)	—	no fix	2022-04-12	= 0.15.0
CVE-2023-30843US	medium6.5	0.63% (50th)	—	1.7.0	2023-04-26	< 1.7.0
CVE-2026-105858US	—	0.47% (41st)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105857US	—	0.43% (37th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105865US	—	0.38% (32nd)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105863US	critical9.4	0.38% (31st)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105866US	high7.5	0.37% (31st)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105854US	high7.5	0.35% (29th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105859US	—OT elevated	0.35% (28th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-34750US	—	0.34% (27th)	—	3.78.0	2026-04-01	< 3.78.0
CVE-2026-27567US	medium4.8	0.34% (27th)	—	3.75.0	2026-02-24	< 3.75.0
CVE-2026-34747US	high8.2	0.32% (24th)	—	3.79.1	2026-04-01	< 3.79.1
CVE-2026-105850US	high8.2	0.31% (24th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-34751US	—	0.31% (23rd)	—	3.79.1	2026-04-01	< 3.79.1
CVE-2026-105849US	high8.3OT elevated	0.30% (23rd)	—	3.90.0	2026-10-06	2 versions
CVE-2026-34746US	—	0.30% (22nd)	—	3.79.1	2026-04-01	< 3.79.1
CVE-2026-105856US	high8.3	0.29% (22nd)	—	3.90.0	2026-10-06	2 versions
CVE-2026-34748US	—	0.29% (21st)	—	3.78.0	2026-04-01	< 3.78.0
CVE-2026-105862US	—	0.27% (19th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105852US	high7.5OT elevated	0.27% (19th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105853US	medium6.5	0.26% (17th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105851US	high8.1OT elevated	0.25% (16th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105855US	high7.1	0.25% (16th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105848US	critical9.6OT elevated	0.24% (16th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105847US	medium6.5	0.24% (16th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105846US	—	0.22% (13th)	—	3.88.0	2026-10-06	2 versions
CVE-2026-105867US	medium6.5	0.22% (12th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-25574US	—	0.22% (12th)	—	3.74.0	2026-02-06	< 3.74.0
CVE-2026-106100US	—	0.22% (12th)	—	3.87.0	2026-10-06	2 versions
CVE-2026-105864US	medium4.3OT elevated	0.20% (9th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105860US	high7.1OT elevated	0.19% (9th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105868US	high7.1	0.17% (6th)	—	3.90.0	2026-10-06	2 versions
CVE-2026-105861US	high8.2	0.13% (3rd)	—	3.90.0	2026-10-06	2 versions
CVE-2026-34749US	—	0.13% (3rd)	—	3.79.1	2026-04-01	< 3.79.1

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-639Authorization Bypass Through User-Controlled Key5 CVEs
CWE-862Missing Authorization5 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor4 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type3 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')3 CVEs
CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-284Improper Access Control2 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE35 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan