BIT-MONGODB-2026-18704 Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations

An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an...

BIT-MONGODB-2026-18697 Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos

An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos router process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: lib: objagg: Fixed general protection fault The library supports the aggregation of objects into other objects only if the parent object does not have a parent itself. In other words, nesting is not supported. Aggregation occurs ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fixed the receive ring space parameters when XDP is active. The MTU setting at the time a XDP multi-buffer is attached determines whether the aggregation ring will be used and the rxskbfunc handler. This is done in...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. The QuerySet.annotate, aggregate, and extra methods are vulnerable to SQL injection when column aliases are used, through a crafted dictionary with dictionary expansion as part of the kwargs parameters...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: Avoid OGM aggregation when skbtailroom is insufficient. When the OGM aggregation state is toggled at runtime, an existing forwarded packet may have been allocated only with packetlen bytes, while a later packet can...

CVE-2026-80943

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92dutxfilldesc uses ieee80211gettid to read the QoS TID from the 802.11 header and then uses it as an index into staentry-tids. ieee80211gettid returns the low 4-bit...

CVE-2026-80943

CVE-2026-80943 is an out-of-bounds array access in the Linux kernel's rtlwifi driver (rtl8192du). The function rtl92du_tx_fill_desc() uses a QoS TID value (range 0–15) as an index into sta_entry->tids[], which only allocates 9 entries (MAX_TID_COUNT). A TID greater than 8 therefore reads past ...

EUVD-2026-75367

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested arra...

CVE-2026-87803

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested arra...

CVE-2026-87803

CVE-2026-87803 is an authorization bypass in Countly Server DBViewer caused by flawed sub-pipeline detection in the aggregation stage sanitizer at the /o/db endpoint. When the sanitizer encounters an unrecognized key such as the undocumented MongoDB-internal $_internalInhibitOptimization, it misc...

CVE-2026-87803

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested arra...

CVE-2026-87803

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested arra...

PT-2026-89354

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested arra...

CVE-2026-87803: Incorrect Authorization

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested arra...

worldmonitor v2.10.0

World Monitor 简体中文 | 日本語 | Русский Real-time global intelligence dashboard — AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface. !Happy...

Linux Distros Unpatched Vulnerability : CVE-2026-82052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server mongod. Under certain specif...

Linux Distros Unpatched Vulnerability : CVE-2026-82059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal...

Linux Distros Unpatched Vulnerability : CVE-2026-82074

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a special...

Linux Distros Unpatched Vulnerability : CVE-2026-82073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks...