CVE-2026-34748

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. This issue has been patched in version 3.78.0.

• CWE-79

• https://github.com/payloadcms/payload/security/advisories/GHSA-mmxc-95ch-2j7cMitigation, Vendor Advisory

Published

Apr 1, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34742The Go MCP SDK used Go's standard encoding/json. Prior to ve…8.1
• CVE-2026-34743XZ Utils provide a general-purpose data-compression library …5.3
• CVE-2026-34744Mantis Bug Tracker (MantisBT) is an open source issue tracke…5.3
• CVE-2026-34745Fireshare facilitates self-hosted media and link sharing. Pr…9.1
• CVE-2026-34746Payload is a free and open source headless content managemen…7.7
• CVE-2026-34747Payload is a free and open source headless content managemen…8.2
• CVE-2026-34749Payload is a free and open source headless content managemen…5.4
• CVE-2026-3475The Instant Popup Builder plugin for WordPress is vulnerable…5.3
• CVE-2026-34750Payload is a free and open source headless content managemen…6.5
• CVE-2026-34751Payload is a free and open source headless content managemen…9.1
• CVE-2026-34752Haraka is a Node.js mail server. Prior to version 3.1.4, sen…7.5
• CVE-2026-34753vLLM is an inference and serving engine for large language m…5.4