CVE-2026-13297: Improper Neutralization of Special Elements Used in a Template Engine

IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack...

PT-2026-85743

IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack...

Security Bulletin: MongoDB Enterprised Advanced affected by: Path Traversal (CVE-2026-49356)

Summary There are vulnerabilities in core-7.26.10.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-49356. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-49356 DESCRIPTION: Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc...

Security Bulletin: MongoDB Enterprised Advanced affected by: Open Redirect (CVE-2026-40181)

Summary There are vulnerabilities in router-1.23.2.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-40181. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-40181 DESCRIPTION: React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7...

Security Bulletin: MongoDB Enterprised Advanced affected by: NULL Pointer Dereference (CVE-2026-8723)

Summary There are vulnerabilities in qs-6.14.2.tgz, qs-6.15.0.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-8723. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-8723 DESCRIPTION: Summary qs.stringify throws TypeError when called with...

Security Bulletin: MongoDB Enterprised Advanced affected by: Uncontrolled Recursion (CVE-2026-45205)

Summary There are vulnerabilities in commons-configuration2-2.10.1.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-45205. The vulnerability has/vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in...

Security Bulletin: MongoDB Enterprised Advanced affected by: CRLF Injection (CVE-2026-41417)

Summary There are vulnerabilities in netty-codec-http-4.1.132.Final.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-41417. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-41417 DESCRIPTION: Netty allows request-line validation to be bypassed when a...

Security Bulletin: MongoDB Enterprised Advanced affected by: Deserialization of Untrusted Data (CVE-2026-42778, CVE-2026-42779)

Summary There are vulnerabilities in mina-core-2.2.4.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-42778, CVE-2026-42779. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-42778 DESCRIPTION: The fix for CVE-2026-41409 was not applied to the 2.1.X...

Security Bulletin: MongoDB Enterprised Advanced affected by: Cross-site Scripting (CVE-2026-33916)

Summary There are vulnerabilities in handlebars-4.7.7.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33916. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-33916 DESCRIPTION: Handlebars provides the power necessary to let users build semantic...

Security Bulletin: MongoDB Enterprised Advanced affected by: Code Injection, Improper Check for Unusual or Exceptional Conditions, Cross-site Scripting (CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941)

Summary There are vulnerabilities in handlebars-4.7.7.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-33937 DESCRIPTION:...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Authorization (CVE-2026-33186)

Summary There are vulnerabilities in google.golang.org/grpc-v1.78.0 used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33186. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Versions pri...

Security Bulletin: MongoDB Enterprised Advanced affected by: CRLF Injection (CVE-2026-39983)

Summary There are vulnerabilities in basic-ftp-5.2.0.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-39983. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-39983 DESCRIPTION: basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows F...

Security Bulletin: MongoDB Enterprised Advanced affected by: Allocation of Resources Without Limits or Throttling (CVE-2026-35469)

Summary There are vulnerabilities in github.com/moby/spdystream-v0.5.0 used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-35469. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-35469 DESCRIPTION: spdystream is a Go library for multiplexing streams over SPD...

Security Bulletin: MongoDB Enterprised Advanced affected by: Deserialization of Untrusted Data (CVE-2026-41409, CVE-2026-41635)

Summary There are vulnerabilities in mina-core-2.2.4.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-41409, CVE-2026-41635. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-41409 DESCRIPTION: The fix for CVE-2024-52046 in Apache MINA...

Security Bulletin: MongoDB Enterprised Advanced affected by: Allocation of Resources Without Limits or Throttling (CVE-2025-8916)

Summary There are vulnerabilities in bcpkix-fips-1.0.7.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-8916. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-8916 DESCRIPTION: Allocation of Resources Without Limits or Throttling vulnerability in...

CVE-2026-12526

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

EUVD-2026-69846

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

CVE-2026-12526

The Advanced Custom Fields: Extended WordPress plugin (versions before 0.9.2.7 ) contains an unauthenticated administrator account takeover vulnerability in its front-end Forms module . The root cause is a failure to verify if a requester is authorized to edit the targeted user account during the...

CVE-2026-12526 Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

CVE-2026-12526 Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...