@jhb.software vulnerabilities

Products

• @jhb.software/payload-cloudinary-plugin 1
• payload-alt-text-plugin 1

Latest @jhb.software CVEs

Newest publication first

1. CVE-2026-59965 @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

   Published 2026-09-15

   High·CVSS 7.1 EPSS 0.38%

   Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user, while alt-text/src/e...

2. GHSA-h5x8-xp6m-x6q4 @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

   Published 2026-06-19

   High·CVSS 7.1

   Arbitrary Cloudinary API Parameter Signing in @jhb.software/payload-cloudinary-plugin Summary @jhb.software/payload-cloudinary-plugin v0.3.4 exposes a server-side signing endpoint (POST /api/cloudinary-generate-signature) that passes attacker-supplied paramsToSign directly to clo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.