CLEANSTART-2026-AD27625 Security fixes for CVE-2022-25881, CVE-2022-33987, CVE-2025-25285, CVE-2025-62718, CVE-2025-69873, CVE-2026-21637, CVE-2026-23745, CVE-2026-24842, CVE-2026-26960, CVE-2026-2950, CVE-2026-29786, CVE-2026-31802, CVE-2026-33036, CVE-2026-33349, CVE-2026-33750, CVE-2026-33916, CVE-2026-33937, CVE-2026-41650, CVE-2026-4800, CVE-2026-4923, CVE-2026-4926, ghsa-23c5-xmqv-rm74, ghsa-2qvq-rjwj-gvw9, ghsa-2w6w-674q-4c4q, ghsa-3mfm-83xf-c92r, ghsa-3p68-rc4w-qgx5, ghsa-3ppc-4f35-3m26, ghsa-3v7f-55p6-f55p, ghsa-442j-39wm-28r2, ghsa-48c2-rrv3-qjmp, ghsa-72xf-g2v4-qvf3, ghsa-7r86-cg39-jmmj, ghsa-7rx3-28cr-v5wh, ghsa-9cx6-37pm-9jff, ghsa-c2c7-rcm5-vvqj, ghsa-chqc-8p9q-pq6q, ghsa-f23m-r3pf-42rh, ghsa-f886-m6hf-6m8v, ghsa-gh4j-gqv2-49f6, ghsa-j3q9-mxjg-w52f, ghsa-pfrx-2q88-qq97, ghsa-r5fr-rjxr-66jc, ghsa-rc47-6667-2j5j, ghsa-rmvr-2pp2-xj38, ghsa-rp42-5vxx-qpwr, ghsa-w5hq-g745-h8pq, ghsa-xhpv-hc6g-r9c6, ghsa-xjpj-3mr7-gcpf applied in versions: 2.6.0-r1, 2.6.0-r2, 2.6.0-r3, 2.6.0-r4

🗓️ 18 May 2026 13:41:09Reported by GoogleType

osv🔗 osv.dev👁 10 Views

Security fixes for Mongosh vulnerabilities 2.6.0-r1 to 2.6.0-r4; resolved in later releases.

Reporter	Title	Published	Views	Family All 2113
vulnersOsv	@adenta/cms (>=0.0.6 <=1.1.1-0), @adobe/helix-deploy (>=11.0.19 <=11.1.15) +294 more potentially affected by CVE-2026-31802 via tar (>=7.0.0 <=7.5.10)	10 Mar 202623:44	–	vulnersosv
vulnersOsv	@bynder/bynder-js-sdk (=2.5.3), @craftgate/craftgate (=1.0.66) +3 more potentially affected by CVE-2025-62718 +1 more via axios (=0.31.0)	24 Apr 202619:20	–	vulnersosv
vulnersOsv	org.webjars.npm:chai-backbone (=0.9.2), org.webjars.npm:express (=5.1.0) +5 more potentially affected by CVE-2026-4926 via org.webjars.npm:path-to-regexp (=8.2.0)	26 Mar 202620:34	–	vulnersosv
vulnersOsv	com.newmediaworks:nmw-oss-website (>=1.7.0 <=1.11.0), com.pragmatickm:website (>=1.10.0 <=2.0.0) +102 more potentially affected by CVE-2021-23337 +1 more via org.webjars.npm:lodash (>=4.0.0 <=4.17.5)	31 Mar 202623:02	–	vulnersosv
vulnersOsv	@dojo/cli-test-intern (>=0.1.0 <=2.0.0-beta3.1), express_mvc (>=4.1.1 <=4.3.10) +7 more potentially affected by CVE-2025-13465 +1 more via lodash-amd (>=4.16.4 <=4.17.23)	31 Mar 202623:02	–	vulnersosv
vulnersOsv	@algolia/coquille (>=0.0.2 <=0.0.13), @candlelabs/sdk (>=1.0.1 <=1.0.2) +21 more potentially affected by CVE-2026-33750 via brace-expansion (>=0.0.0 <=1.1.11)	26 Mar 202618:29	–	vulnersosv
vulnersOsv	@activepieces/piece-amazon-s3 (>=0.5.4 <=0.5.9), @activepieces/piece-amazon-ses (>=0.0.1 <=0.1.3) +1174 more potentially affected by CVE-2026-33349 via fast-xml-parser (>=5.0.1 <=5.5.6)	19 Mar 202619:13	–	vulnersosv
vulnersOsv	@activepieces/piece-amazon-s3 (>=0.5.4 <=0.5.9), @activepieces/piece-amazon-ses (>=0.0.1 <=0.1.3) +1170 more potentially affected by CVE-2026-33036 via fast-xml-parser (>=5.0.1 <=5.5.5)	17 Mar 202619:45	–	vulnersosv
vulnersOsv	com.github.linyuzai:concept-router-spring-boot-starter (=1.1.0), org.webjars.npm:cacheable-request (=2.1.4) +5 more potentially affected by CVE-2022-25881 via org.webjars.npm:http-cache-semantics (=3.8.1)	31 Jan 202306:30	–	vulnersosv
vulnersOsv	com.codbex.atlas:codbex-atlas-application (>=2.62.0 <=2.110.0), com.codbex.gaia:codbex-gaia-application (>=2.61.0 <=2.64.0) +22 more potentially affected by CVE-2026-26278 +1 more via org.webjars.npm:fast-xml-parser (>=4.5.3 <=5.8.0)	17 Mar 202619:45	–	vulnersosv

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AD27625.json
osv	www.osv.dev/vulnerability/CVE-2022-25881
osv	www.osv.dev/vulnerability/CVE-2022-33987
osv	www.osv.dev/vulnerability/CVE-2025-25285
osv	www.osv.dev/vulnerability/CVE-2025-62718
osv	www.osv.dev/vulnerability/CVE-2025-69873
osv	www.osv.dev/vulnerability/CVE-2026-21637
osv	www.osv.dev/vulnerability/CVE-2026-23745
osv	www.osv.dev/vulnerability/CVE-2026-24842
osv	www.osv.dev/vulnerability/CVE-2026-26960

21 May 2026 08:45Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.19.8 - 9.9

CVSS 25

CVSS 48.2

CVSS 35.9

EPSS0.02566

SSVC