payload-plugins vulnerabilities

2 known vulnerabilities in payload-plugins from Jhb-software. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  payload-plugins: Improper Verification of Cryptographic Signature

  CVE-2026-58200Sep 15, 2026Jhb-software

  Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/g

• 7.1 High severity

  payload-plugins: Incorrect Authorization

  CVE-2026-59965Sep 15, 2026Jhb-software

  Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user,