PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption

SummaryPyMongo passed the KMS endpoint of a data key verbatim into parsehost, which returns any string ending in .sock unchanged instead of validating it as a hostname and port. The driver's connection code then treats such an address as a Unix domain socket path and connects to it with AFUNIX...

CVE-2026-109959 EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/id, which skips the...

CVE-2026-109959

EspoCRM versions 4.0.0 before 10.0.7 are vulnerable to an access control flaw. Authenticated users with stream access to a parent record can bypass the NoteAccessControl filter by requesting GET /Note/{id}. This allows them to read audited field values restricted by field-level security , specifi...

CVE-2026-109337

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are...

EUVD-2026-97639

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are...

CVE-2026-109335 SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN...

EUVD-2026-97638

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive...

CVE-2026-109335

SurrealDB versions 3.0.0 before 3.3.0 are vulnerable to an information disclosure flaw involving COMPUTED fields . The root cause allows users to bypass field-level SELECT permissions by accessing records where readable COMPUTED fields are derived from hidden fields. Additionally, attackers can u...

CVE-2026-109337: Observable Discrepancy

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are...

CVE-2026-109336: Incorrect Authorization

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive...

CVE-2026-109335: Exposure of Sensitive Information to an Unauthorized Actor

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN...

CVE-2026-108861 Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the executemethod tool. Attackers or prompt-injected agents can call read or searchread through executemethod naming denied fields to receive their value...

CVE-2026-108861 Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the executemethod tool. Attackers or prompt-injected agents can call read or searchread through executemethod naming denied fields to receive their value...

CVE-2026-108861

Odoo MCP versions 1.0.0 through 1.3.2 are vulnerable to an information disclosure flaw within the execute_method tool . This vulnerability allows MCP clients or prompt-injected agents to bypass field-level Access Control Lists (ACL) . By invoking the execute_method tool and naming fields that sho...

EUVD-2026-93515

Payload: Field-level write access bypass in Payload on MongoDB...

Payload: Field-level write access bypass in Payload on MongoDB

Impact A vulnerability in field-level access control could allow an authenticated user to modify fields they are not permitted to change on documents they can otherwise update. You are affected if: Payload version 3.87.0 or a 4.0.0-canary release before 4.0.0-canary.20 using the MongoDB adapter...

GHSA-4WW4-68Q3-H7G5 Payload: Field-level write access bypass in Payload on MongoDB

Impact A vulnerability in field-level access control could allow an authenticated user to modify fields they are not permitted to change on documents they can otherwise update. You are affected if: Payload version 3.87.0 or a 4.0.0-canary release before 4.0.0-canary.20 using the MongoDB adapter...

CVE-2026-106100 Payload: Field-level write access bypass in Payload on MongoDB

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to...

EUVD-2026-93499

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions...

CVE-2026-105855

The Payload headless content management system contains a vulnerability in versions before 3.90.0 and canary versions before 4.0.0-canary.34 . The server fails to correctly enforce field-level access.update restrictions on the password field within an authentication collection. This improper acce...