How many CVEs have a located fix in payloadcms/payload?

29 published CVEs have a fix traced to functions in payloadcms/payload, touching 110 functions across 146 files.

Which function in payloadcms/payload has been patched by the most CVEs?

map in packages/drizzle/src/postgres/createJSONQuery/index.ts has been changed by 2 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in payloadcms/payload?

The median fix changes 108 lines. 21% of fixes change 20 lines or fewer, and 17% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

typescript

javascript

#163 of 500 repositories

payloadcms/payload

Name: payloadcms/payload: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix October 13, 2026

29

CVE fixes located

Published CVEs

110

Functions patched

Distinct function sites

146

Files patched

Distinct source files

2025–2026

Years covered

By CVE publication date

Overview

29 published CVEs have a fix traced to functions in payloadcms/payload, the earliest published in 2025. Those fixes changed 110 distinct functions across 146 files, in 870 patch hunks.

Among the 500 repositories tracked here, payloadcms/payload ranks #163 by the number of CVEs with a located fix.

Most patched functions

Functions in payloadcms/payload changed by the most CVE fixes.

Most patched files

Files in payloadcms/payload changed by the most CVE fixes.

1packages/payload/src/index.ts5 CVEs · 2 functions
2packages/payload/src/auth/types.ts4 CVEs · 4 functions
3packages/payload/src/auth/getAuthFields.ts4 CVEs · 0 functions
4packages/payload/src/auth/operations/refresh.ts3 CVEs · 1 functions
5packages/payload/src/auth/strategies/jwt.ts3 CVEs · 1 functions
6packages/storage-s3/src/generateSignedURL.ts3 CVEs · 1 functions
7packages/payload/src/auth/getFieldsToSign.ts3 CVEs · 0 functions
8packages/payload/src/auth/operations/login.ts3 CVEs · 0 functions
9packages/payload/src/collections/config/defaults.ts3 CVEs · 0 functions
10packages/payload/src/exports/shared.ts3 CVEs · 0 functions

Fix size

How much code a CVE fix in payloadcms/payload changes, with backports counted once.

108

Median lines changed

Added plus removed, per CVE

21%

Fixes of 20 lines or fewer

Share of CVE fixes

17%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in payloadcms/payload, and the functions each fix changed.

SQL Injection in Payload CMS
CVE-2026-63316JSONPathSegment map
High · CVSS 8.7
EPSS 0.3%2026-10-13
Payload: Field-level write access bypass in Payload on MongoDB
CVE-2026-106100stripNullRows Args
High · CVSS 7.1
EPSS 0.2%2026-10-06
Payload: Uploaded XML files could execute same-origin JavaScript
CVE-2026-105868validateSvg some detectSvgFromXml
High · CVSS 8.6
EPSS 0.2%2026-10-06
Payload: Client uploads could overwrite S3 objects
CVE-2026-105867min
High · CVSS 7.1
EPSS 0.2%2026-10-06
Payload: Unauthenticated account-lockout denial of service
CVE-2026-105866StoredForgotPasswordRequest update ClientCollectionConfig
Medium · CVSS 6.9
EPSS 0.4%2026-10-06
Payload: Incomplete validation during the upload file lifecycle
CVE-2026-105865startsWith Options
High · CVSS 8.1
EPSS 0.4%2026-10-06
Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant
CVE-2026-105864
Medium · CVSS 5.3
EPSS 0.2%2026-10-06
Payload authentication token field handling issue
CVE-2026-105863JWTToken JWTAuthVersion DatabaseAdapter
Critical · CVSS 9.2
EPSS 0.4%2026-10-06
Payload: Bypassed sanitization of user uploaded SVGs
CVE-2026-105862validateSvg some detectSvgFromXml
High · CVSS 8.7
EPSS 0.3%2026-10-06
Payload external upload trust validation issue
CVE-2026-105861Args UploadConfig ExternalFileHeaderFilterContext
High · CVSS 7.2
EPSS 0.1%2026-10-06
Payload: Tenant authorization bypass in Multi-Tenant Plugin
CVE-2026-105860Args
High · CVSS 7.1
EPSS 0.2%2026-10-06
Payload: Unauthorized update to collection documents
CVE-2026-105859generateNKeysBetween
Critical · CVSS 9.8
EPSS 0.4%2026-10-06

Get an alert for each new payloadcms/payload CVE, with the patched functions and AI-written analysis.

Monitor payload CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

android.googlesource.com/platform-frameworks-native29 CVEs ash-project/ash29 CVEs debian/cacti29 CVEs electron/electron29 CVEs matrix-org/synapse29 CVEs MervinPraison/PraisonAI29 CVEs mybb/mybb29 CVEs openstack/keystone29 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in payloadcms/payload.

How many CVEs have a located fix in payloadcms/payload?: 29 published CVEs have a fix traced to functions in payloadcms/payload, touching 110 functions across 146 files.
Which function in payloadcms/payload has been patched by the most CVEs?: map in packages/drizzle/src/postgres/createJSONQuery/index.ts has been changed by 2 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in payloadcms/payload?: The median fix changes 108 lines. 21% of fixes change 20 lines or fewer, and 17% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track payloadcms/payload CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing