{"metadata": {"vulnerability": "cve-2026-109337", "count": 11, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109337", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T14:19:01.652Z", "date_only": false, "value": "2026-10-12T14:19:01.652Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-109337", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T16:05:24.429Z", "date_only": false, "value": "2026-10-12T16:05:24.429Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-109337", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T16:05:24.429Z", "date_only": false, "value": "2026-10-12T16:05:24.429Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-109337", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-12T16:05:24.429Z", "date_only": false, "value": "2026-10-12T16:05:24.429Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109337", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T17:17:29Z", "date_only": false, "value": "2026-10-12T17:17:29Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7C4P-52C9-9VQ7", "record": "GHSA-7C4P-52C9-9VQ7", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T17:17:29.887Z", "date_only": false, "value": "2026-10-12T17:17:29.887", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109337", "record": "FKIE_CVE-2026-109337", "field": "published"}, {"timestamp": "2026-10-12T17:17:30.010Z", "date_only": false, "value": "2026-10-12T17:17:30.010", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109337", "record": "FKIE_CVE-2026-109337", "field": "lastModified"}, {"timestamp": "2026-10-12T17:34:08.380Z", "date_only": false, "value": "2026-10-12T17:34:08.380364Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117429137928878456", "record": "CVE-2026-109337", "field": "creation_timestamp", "uuid": "d0ba5839-4488-4216-9b55-a6085ea4ee63", "content": "CVE-2026-109337 SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109337https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jm88-9wvx-6h4qhttps://www.vulncheck.com/advisories/surrealdb-before-3.3.0-field-permission-bypass-via-live-select-where-clause#surrealdb#CVE_2026_109337#bot", "url": "https://infosec.exchange/users/cve/statuses/117429137928878456"}, {"timestamp": "2026-10-12T18:31:50Z", "date_only": false, "value": "2026-10-12T18:31:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7C4P-52C9-9VQ7", "record": "GHSA-7C4P-52C9-9VQ7", "field": "published"}, {"timestamp": "2026-10-12T18:31:50Z", "date_only": false, "value": "2026-10-12T18:31:50Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7C4P-52C9-9VQ7", "record": "GHSA-7C4P-52C9-9VQ7", "field": "modified"}]}