CRITICAL9.4npm
GHSA-65w6-pf7x-5g85· CVE-2026-39397@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections
Modified: 4/8/2026
package
npm/@delmaredigital/payload-puck
pkg:npm/%40delmaredigital/payload-puck