FLAT-UYAU3 (CVE-2026-105856)
SQL injection In @payloadcms/db-d1-sqlite
6.2
Medium
Ecosystem: Npm
Component: @payloadcms/db-d1-sqlite
FLAT-NAZTT (CVE-2026-105860)
Improper authorization control for web services In @payloadcms/plugin-multi-tenant
4.9
Medium
Ecosystem: Npm
Component: @payloadcms/plugin-multi-tenant
FLAT-97XJT (CVE-2026-105864)
Improper authorization control for web services In @payloadcms/plugin-multi-tenant
1.3
Low
Ecosystem: Npm
Component: @payloadcms/plugin-multi-tenant
FLAT-Z1RP4 (CVE-2026-105867)
Improper authorization control for web services In @payloadcms/storage-s3
5.0
Medium
Ecosystem: Npm
Component: @payloadcms/storage-s3
FLAT-JZ6GH (CVE-2026-105857)
Server side template injection In @payloadcms/plugin-form-builder
9.1
Critical
Ecosystem: Npm
Component: @payloadcms/plugin-form-builder
FLAT-ZBGTY (CVE-2026-106100)
Restricted fields manipulation In @payloadcms/db-mongodb
2.3
Low
Ecosystem: Npm
Component: @payloadcms/db-mongodb
FLAT-SX18Z (CVE-2026-105850)
Non-encrypted confidential information In @payloadcms/plugin-ecommerce
6.8
Medium
Ecosystem: Npm
Component: @payloadcms/plugin-ecommerce
FLAT-8ILZ3 (CVE-2026-105848)
Improper authorization control for web services In @payloadcms/plugin-stripe
2.4
Low
Ecosystem: Npm
Component: @payloadcms/plugin-stripe
FLAT-67IBE (CVE-2026-105806)
Improper authorization control for web services In @payloadcms/plugin-mcp
6.2
Medium
Ecosystem: Npm
Component: @payloadcms/plugin-mcp
FLAT-ZKH0Q (CVE-2026-105844)
Prototype Pollution In @payloadcms/plugin-import-export
8.1
High
Ecosystem: Npm
Component: @payloadcms/plugin-import-export
FLAT-XE78D (CVE-2026-34750)
Lack of data validation - Path Traversal In @payloadcms/storage-gcs
2.3
Low
Ecosystem: Npm
Component: @payloadcms/storage-gcs
FLAT-D10UW (CVE-2026-34748)
Server side cross-site scripting In @payloadcms/next
5.7
Medium
Ecosystem: Npm
Component: @payloadcms/next
FLAT-OR3GM (CVE-2026-34751)
Lack of data validation In @payloadcms/graphql
8.0
High
Ecosystem: Npm
Component: @payloadcms/graphql
FLAT-DOMRA (CVE-2026-25544)
SQL injection In @payloadcms/drizzle
6.9
Medium
Ecosystem: Npm
Component: @payloadcms/drizzle
FLAT-X6NGM (CVE-2025-4644)
Session Fixation In @payloadcms/graphql
1.3
Low
Ecosystem: Npm
Component: @payloadcms/graphql