@contentql/core (>=0.1.2, <=0.3.4), @frogbotai/db-mongodb (>=0.0.1, <=0.21.0) +3 more potentially affected by CVE-2026-106100 via @payloadcms/db-mongodb (>=3.0.0-beta.48, <=3.85.1)

@payloadcms/db-mongodb NPM version =3.0.0-beta.48, =0.1.2, =0.0.1, =0.1.0, =0.1.4, =0.1.5 Source cves: CVE-2026-106100 Source advisory: OSV:GHSA-4WW4-68Q3-H7G5...

@contentql/core (>=0.1.2, <=0.3.4), @frogbotai/db-mongodb (>=0.0.1, <=0.21.0) +3 more potentially affected by CVE-2026-106100 via @payloadcms/db-mongodb (>=3.0.0-beta.48, <=3.85.1)

@payloadcms/db-mongodb NPM version =3.0.0-beta.48, =0.1.2, =0.0.1, =0.1.0, =0.1.4, =0.1.5 Source cves: CVE-2026-106100 Source advisory: GHSA-4WW4-68Q3-H7G5...

EUVD-2026-93515

Payload: Field-level write access bypass in Payload on MongoDB...

GHSA-4WW4-68Q3-H7G5 Payload: Field-level write access bypass in Payload on MongoDB

Impact A vulnerability in field-level access control could allow an authenticated user to modify fields they are not permitted to change on documents they can otherwise update. You are affected if: Payload version 3.87.0 or a 4.0.0-canary release before 4.0.0-canary.20 using the MongoDB adapter...

Payload: Field-level write access bypass in Payload on MongoDB

Impact A vulnerability in field-level access control could allow an authenticated user to modify fields they are not permitted to change on documents they can otherwise update. You are affected if: Payload version 3.87.0 or a 4.0.0-canary release before 4.0.0-canary.20 using the MongoDB adapter...

Improper Neutralization Of Special Elements In Data Query Logic

MongoDB Python Driver is vulnerable to Improper Neutralization of Special Elements in Data Query Logic. The vulnerability is due to improper handling of caller-supplied structured file identifiers, which allows an authenticated attacker to manipulate GridFS queries to access unintended stored fil...

CVE-2026-106119

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...

@bat-ai/core (>=0.1.0, <=0.1.4), @biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14) +30 more potentially affected by CVE-2026-106119 via @langchain/mongodb (>=0.0.1, <=1.1.0)

@langchain/mongodb NPM version =0.0.1, =0.1.0, =0.1.13, =0.1.0, =2.35.2, =2.32.7, =2.32.0, =2.34.0, =1.0.5, =0.1.4, =1.0.0, =1.0.27 and more Source cves: CVE-2026-106119 Source advisory: MEND:CVE-2026-106119...

CVE-2026-106100

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to...

@contentql/core (>=0.1.2, <=0.3.4), @frogbotai/db-mongodb (>=0.0.1, <=0.21.0) +5 more potentially affected by CVE-2026-106100 via @payloadcms/db-mongodb (>=1.7.5, <=3.85.1)

@payloadcms/db-mongodb NPM version =1.7.5, =0.1.2, =0.0.1, =0.1.0, =0.1.0, =0.1.4, =0.0.1-beta.1, =0.0.1-beta.5 Source cves: CVE-2026-106100 Source advisory: MEND:CVE-2026-106100...

CVE-2026-106100 Payload: Field-level write access bypass in Payload on MongoDB

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to...

CVE-2026-106100 Payload: Field-level write access bypass in Payload on MongoDB

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to...

CVE-2026-106100

The Payload headless content management system contains a field-level write access control bypass in the @payloadcms/db-mongodb adapter. Specifically, versions before 3.87.0 and canary versions before 4.0.0-canary.20 allow an authenticated user with document update permissions to modify restricte...

CVE-2026-106100 Payload: Field-level write access bypass in Payload on MongoDB

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to...

CVE-2026-106100

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to...

Missing Authorization

Overview @payloadcms/db-mongodb is a The officially supported MongoDB database adapter for Payload Affected versions of this package are vulnerable to Missing Authorization via the contains query operator on relationship, upload, and join fields, where access control filters injected for a relate...

@contentql/core (>=0.1.2, <=0.3.4), @frogbotai/db-mongodb (>=0.0.1, <=0.23.0) +3 more potentially affected by CVE-2026-105852 via @payloadcms/db-mongodb (>=3.0.0-beta.48, <=3.88.0)

@payloadcms/db-mongodb NPM version =3.0.0-beta.48, =0.1.2, =0.0.1, =0.1.0, =0.1.4, =0.1.5 Source cves: CVE-2026-105852 Source advisory: SNYK:JS-PAYLOADCMSDBMONGODB-20571385...

EUVD-2026-92817

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-106119: Improper Neutralization of Special Elements in Data Query Logic

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...

PT-2026-106840

Name of the Vulnerable Software and Affected Versions LangChain versions prior to 1.3.1 Description In the MongoDBChatMessageHistory component, the system fails to enforce the required string type for untrusted structured session identifiers at runtime. This allows a session identifier to be...