Elasticsearch 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-196)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursio...

worldmonitor — Updated!

World Monitor 简体中文 | 日本語 | Русский Real-time global intelligence dashboard — AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface. !Happy...

CVE-2026-40858

Reproducción de la deserialización insegura del repositorio de agregación remota camel-infinispan CVE-2026-40858 Este proyecto demuestra una vulnerabilidad de deserialización de Java en el componente camel-infinispan de Apache Camel, registrada como CVE-2026-40858. El repositorio de agregación...

Elasticsearch 9.0.x < 9.4.6 / 9.5.x < 9.5.2 DoS (ESA-2026-196)

The version of Elasticsearch installed on the remote host is 9.0.x prior to 9.4.6, or 9.5.x prior to 9.5.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-196 advisory. - Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: mt76: mt7921 – Fixed a skb leak caused by missing txs in AMSDU. Txs may be dropped if the frame is aggregated in AMSDU. When this problem occurs, some SKBs are held by the driver, causing the network to stop temporarily. Ev...

awesome-websocket-security

Impresionante Seguridad de WebSockets Una colección de CVEs, investigaciones y materiales de referencia relacionados con la seguridad de WebSocket Contenido Vulnerabilidades de librerías WebSocket Charlas de conferencias Debilidades comunes de WebSocket Herramientas de seguridad WebSocket Informe...

DeepGuard

DeepGuard 📖 Resumen del Proyecto DeepGuard es un enfoque innovador de generación de código seguro que mejora la capacidad de los modelos de lenguaje de gran tamaño para generar código seguro mediante técnicas de agregación semántica multicapa. Este método identifica y mitiga eficazmente las...

statecraftcyber

Statecraft Cyber Intelligence Plataforma de threat intelligence en portugués construida desde cero como proyecto personal de Blue Team. Agrega datos de fuentes abiertas globales y los transforma en briefings técnicos, noticias clasificadas, CVEs enriquecidos e IOCs estructurados — todo en PT-BR,...

CVE-2026-97570

A flaw was found in the Broadcom NetXtreme-E bnxten driver in the Linux kernel. Due to improper bounds checking when mapping firmware Transparent Packet Aggregation TPA identifiers, software aggregation IDs can exceed the allocated memory for receive structures. During packet reception, this issu...

Backdoor Mitigation in Decentralized LLM Fine-Tuning

Decentralized large language model LLM fine-tuning lets organizations collaboratively train a shared LLM on data they cannot pool, without a central coordinator. In every round, each node exchanges a trainable adapter with its neighbors over a communication graph, and then aggregates them. This...

Elasticsearch 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-170)

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.20 9.x: All version...

The vulnerability of the aggregation merging processing mechanism between shards of the MongoDB database management system allows a attacker to cause a service failure.

The vulnerability of the aggregation merging mechanism between shards in the MongoDB database management system is related to an uncontrolled and exploitable condition. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2026-96744 Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence...

CVE-2026-96744

The MongoDB integration for Laravel contains a vulnerability in its cache lock implementation due to improper neutralization of special elements in data query logic. This allows a caller-supplied lock owner value to be evaluated as an aggregation expression instead of a literal value. An authenti...

EUVD-2026-86258

Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence...

PT-2026-98037

Name of the Vulnerable Software and Affected Versions MongoDB integration for Laravel affected versions not specified Description Improper neutralization of special elements in the data query logic within the cache lock implementation allows a caller-supplied lock owner value to be evaluated as a...

BIT-MONGODB-2026-82074 Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...

BIT-MONGODB-2026-82073 Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...

BIT-MONGODB-2026-82059 Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...

BIT-MONGODB-2026-18707 Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service

An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service...