Live data from GitHub and npm, updated daily.
Data last fetched: 2026-10-22
10 active CVEs reported via OSV.dev
Payload vulnerable to API key disclosure through ordinary document reads
Payload's SQLite adapter Session Fixation vulnerability
Payload: ReDoS in Multipart Content-Type Validation
Payload: Bypassed sanitization of user uploaded SVGs
Hidden fields can be leaked on readable collections in Payload
Payload does not invalidate JWTs after log out
Payload authentication token field handling issue
Payload has Authenticated SSRF via Upload Functionality
Payload relationship-query authorization bypass
Payload has an SQL Injection via Query Handling
Other CMS projects in the Node.js ecosystem worth evaluating.
Get SLA-backed support, security patches, and direct access to senior engineers for Payload CMS — without relying on volunteer maintainers.