Payload CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Payload CVE published 2026-10-13

CVE-2026-63316

A SQL injection vulnerability was identified in Payload CMS, allowing an authenticated attacker to perform SQL Injection attacks due to improper neutralization of user input into 'in' and 'not_in' query parameters. The issue was fixed in version 3.90.0 and 4.0.0-canary.34. This vulnerability requires defenders to assess exposure and prioritize updating to fixed versions to prevent SQL injection attacks. T [truncated]