CVE-2026-88033

MongoDB Java Driver 's GridFS component is vulnerable to query-operator injection through improperly neutralized file identifiers. A caller-supplied structured file ID may be interpreted as a query condition rather than a literal value, allowing an authenticated user who can influence the identif...

CVE-2026-88031 GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifie...

CVE-2026-88030 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88028

CVE-2026-88028 affects the polymorphic relation handling in the MongoDB integration for Laravel . The root cause is improper neutralization of special elements in data query logic , which allows a caller-supplied relation identifier to be interpreted as a query condition rather than a literal ide...

CVE-2026-88028 Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can...

CVE-2026-88027 Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated use...

CVE-2026-88025 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier...

CVE-2026-88025

CVE-2026-88025 affects the GridFS component of the MongoDB C# Driver . A caller-supplied structured file identifier is improperly neutralized, allowing it to be interpreted as a query condition rather than a literal identifier (query-operator injection). An authenticated user who can influence th...

CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88022 Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument where method when the operator i...

CVE-2026-88022

CVE-2026-88022 affects the MongoDB integration for Laravel , where improper neutralization of special elements in data query logic allows an array supplied to an explicit equality filter to be interpreted as a query condition rather than a literal value. The vulnerability impacts the three-argume...

starboard

Starboard is joining Trivy. We've announced our plans to discontinue Starboard and merge it into Trivy. Starboard CLI has been reintroduced as trivy kubernetes command and starboard-operator with a focus on trivy capabilities is available as Trivy-Operator. We will not be accepting new...

nebula

Nebula AI Powered Pentesting The Zero Layer workbench Acknowledgement First, I would like to thank Almighty God, who is the source of all knowledge. Without Him, this would not be possible. Nebula brings the working parts of a security engagement into one desktop surface: terminal, code, browser,...

CVE-2025-51397

Exploit Title: LiveHelperChat =4.61 - Stored Cross Site Scripting XSS via Operator Surname Date: 09/06/2025 Exploit Author: Manojkumar J TheWhiteEvil Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/ Software Link:...

renovate-operator

Renovate: The Kubernetes-Native Way Run Renovate on your own infrastructure with CRD-based scheduling, parallel execution, auto-discovery, and a built-in UI. If you self-host Renovate and already run Kubernetes, this operator gives you the control and observability that plain self-hosted setups...

CVE-2026-80351

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

CVE-2026-80354

An authorization bypass vulnerability in Apache Camel K affects the Builder trait mavenProfiles ValueSources during custom resource resolution. A tenant can reference secrets by name in the operator namespace , potentially exposing secrets belonging to other tenants or operator components. The is...

EUVD-2026-75292

Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or operator components. Th...

CVE-2026-80351 Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

EUVD-2026-75291

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...