How many CVEs have patched Args?

6 published CVEs changed Args in payloadcms/payload, in 8 distinct patches totalling 285 changed lines, between 2026 and 2026.

What is the latest CVE that changed Args?

CVE-2026-106100 (Payload: Field-level write access bypass in Payload on MongoDB), published 2026-10-06, changed lines 13 of packages/payload/src/fields/hooks/beforeValidate/promise.ts.

How does Args compare to the rest of payloadcms/payload?

payloadcms/payload has 29 CVEs with a located fix in total; 6 of them changed Args.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

RadicalNotion.AI

Log in Create an account

payloadcms/payload

Type

7 files

Args

Name: Args in payloadcms/payload: CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Defined in 7 files

Last patched October 6, 2026

6

CVEs

That changed this function

8

Distinct patches

Backports counted once

285

Lines changed

Added plus removed

2026

Years

By CVE publication date

Overview

Args in payloadcms/payload was changed by 6 published CVE fixes in 2026, in 8 distinct patches that added or removed 285 lines in total.

The name occurs in 7 files: packages/storage-azure/src/generateSignedURL.ts, packages/plugin-multi-tenant/src/fields/tenantField/index.ts, packages/payload/src/fields/hooks/beforeValidate/promise.ts, packages/plugin-multi-tenant/src/utilities/isValidTenantAssignment.ts, packages/payload/src/uploads/getExternalFile.ts, packages/plugin-multi-tenant/src/hooks/enforceTenantMembership.ts, packages/payload/src/database/queryValidation/validateSearchParams.ts.

payloadcms/payload has 29 CVEs with a located fix in total, so 21% of them touched this function.

CVEs that patched it

Every published CVE whose fix changed Args, newest first, with the lines each fix touched.

Payload: Field-level write access bypass in Payload on MongoDB
CVE-2026-106100 · packages/payload/src/fields/hooks/beforeValidate/promise.ts · line 13 · +1 −0
High · CVSS 7.1
EPSS 0.2%2026-10-06
Payload: Uploaded XML files could execute same-origin JavaScript
CVE-2026-105868 · packages/storage-azure/src/generateSignedURL.ts · lines 8–13 · +3 −0
High · CVSS 8.6
EPSS 0.2%2026-10-06
Payload: Bypassed sanitization of user uploaded SVGs
CVE-2026-105862 · packages/storage-azure/src/generateSignedURL.ts · lines 8–13 · +3 −0
High · CVSS 8.7
EPSS 0.3%2026-10-06
Payload external upload trust validation issue
CVE-2026-105861 · packages/payload/src/uploads/getExternalFile.ts · lines 14–98 · +71 −18
High · CVSS 7.2
EPSS 0.1%2026-10-06
Payload: Tenant authorization bypass in Multi-Tenant Plugin
CVE-2026-105860 · packages/plugin-multi-tenant/src/fields/tenantField/index.ts · lines 41–73 · +21 −3 in 2 hunks
High · CVSS 7.1
EPSS 0.2%2026-10-06
Payload: Tenant authorization bypass in Multi-Tenant Plugin
CVE-2026-105860 · packages/plugin-multi-tenant/src/hooks/enforceTenantMembership.ts · lines 1–83 · +83 −0
High · CVSS 7.1
EPSS 0.2%2026-10-06
Payload: Tenant authorization bypass in Multi-Tenant Plugin
CVE-2026-105860 · packages/plugin-multi-tenant/src/utilities/isValidTenantAssignment.ts · lines 1–81 · +81 −0
High · CVSS 7.1
EPSS 0.2%2026-10-06
Payload relationship-query authorization bypass
CVE-2026-105852 · packages/payload/src/database/queryValidation/validateSearchParams.ts · line 12 · +1 −0
Medium · CVSS 6.9
EPSS 0.3%2026-10-06

Get an alert when the next CVE fix lands in payloadcms/payload, with the patched functions.

Monitor payload CVEs

Other functions in these files

Functions in the same files that CVE fixes also changed.

Other hotspots in the repository

Functions in payloadcms/payload changed by the most CVE fixes.

map2 CVEs · packages/drizzle/src/postgres/createJSONQuery/index.ts getFile2 CVEs · packages/storage-azure/src/getFile.ts detectSvgFromXml2 CVEs · packages/payload/src/uploads/detectSvgFromXml.ts validateSvg2 CVEs · packages/payload/src/uploads/validateSvg.ts createAzureAdapter2 CVEs · packages/storage-azure/src/adapter.ts some2 CVEs · packages/payload/src/uploads/assertClientUploadAllowed.ts

All patched functions in payloadcms/payload

Frequently asked questions

Common questions about CVE fixes to Args.

How many CVEs have patched Args?: 6 published CVEs changed Args in payloadcms/payload, in 8 distinct patches totalling 285 changed lines, between 2026 and 2026.
What is the latest CVE that changed Args?: CVE-2026-106100 (Payload: Field-level write access bypass in Payload on MongoDB), published 2026-10-06, changed lines 13 of packages/payload/src/fields/hooks/beforeValidate/promise.ts.
How does Args compare to the rest of payloadcms/payload?: payloadcms/payload has 29 CVEs with a located fix in total; 6 of them changed Args.
What do the line numbers refer to?: Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track payloadcms/payload CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing