@jhb.software/payload-cloudinary-plugin vulnerabilities

Latest @jhb.software/payload-cloudinary-plugin CVEs

Newest publication first

1. GHSA-h5x8-xp6m-x6q4 @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

   Published 2026-06-19

   High·CVSS 7.1

   Arbitrary Cloudinary API Parameter Signing in @jhb.software/payload-cloudinary-plugin Summary @jhb.software/payload-cloudinary-plugin v0.3.4 exposes a server-side signing endpoint (POST /api/cloudinary-generate-signature) that passes attacker-supplied paramsToSign directly to clo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.