Skip to content
OpenAdvisories

Package · npm

@payloadcms/graphql

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-34751

    Payload has Unvalidated Input in Password Recovery Endpoints

    Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who …

    Payload CMS payload payload @payloadcms/graphql npm