Payload CMS in/not_in query operators allow authenticated SQL injection. Patch to 3.90.0. https://intel.threadlinqs.com/threat/TL-2026-3399 #ThreatIntel #CVE_2026_63316 #payload #PayloadCMS

CVE-2026-105859 - payload
Versions of Payload CMS older than 3.90.0 (and canary builds older than 4.0.0‑canary.34) allow a user to send a special request that changes content items even when they should…

Too many irrelevant or confusing CVEs? Use stackflag.com

#payload #payloadcms #CVE #infosec

CVE-2026-105857 - payload
The free Payload CMS content system’s form‑builder plugin can be tricked into running code on your server if you are using a version older than 3.90.0 (or a canary version older…

Too many irrelevant or confusing CVEs? Use stackflag.com

#payload #payloadcms #CVE #infosec

CVE-2026-105850 - plugin-ecommerce
If you use Payload's e‑commerce plugin with Stripe and are running a version earlier than 3.90.0 (or a pre‑release before 4.0.0‑canary.34), the same order…

Too many irrelevant or confusing CVEs? Use stackflag.com

#pluginecommerce #payloadcms #npm #CVE #infosec

CVE-2026-105844 - plugin-import-export
The free Payload content management system and its import‑export plugin allow anyone on the internet to send specially crafted data that can make the application behave…

Too many irrelevant or confusing CVEs? Use stackflag.com

#payloadcms #npm #CVE #infosec

payload migrate hung 17 minutes in CI: a leftover dev row made it ask ""Would you like to proceed?"" No runner can answer.

The flag never reaches it. One row did.

#payloadcms #devops
abchaudary.me/blog/payload...

Building a thing with @astro.build, @sugarcube.sh and #payloadcms. Really nice! #webdev