Skip to content
OpenAdvisories

Product · jhb-software

payload-plugins

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-58200

    @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

    Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/…

    jhb-software payload-plugins @jhb.software/payload-cloudinary-plugin npm
  • High 7.1
    CVE-2026-59965

    @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

    Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user,…

    jhb-software payload-plugins payload-alt-text-plugin @jhb.software/payload-alt-text-plugin npm