Linux Distros Unpatched Vulnerability : CVE-2026-18688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of- bounds memory read by providing a specially formed...

SUSE CVE-2026-68136

In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...

BIT-MONGODB-2026-13063 libmongocrypt Improper Input Validation Leading to Process Termination

An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively larg...

BIT-MONGODB-2026-13060 $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections...

BIT-MONGODB-2026-13057 Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META

An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due t...

BIT-MONGODB-2026-13055 Server crash via aggregation pipeline expression with compound wildcard index specification

The $internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server mongod. The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an...

PT-2026-73374

The $ internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server mongod. The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an...

PT-2026-73376

An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due t...

PT-2026-73382

An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively larg...

PT-2026-73384

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...

opencve v3.1.0

What is OpenCVE? OpenCVE is a Vulnerability Intelligence Platform that helps you monitor and manage CVEs efficiently. It aggregates vulnerabilities from multiple sources MITRE, NVD, RedHat, Vulnrichment... and lets you filter, track, and organize them by vendor, product, severity, and more. You c...

GO-2026-4529 vulnerabilities

Vulnerabilities for packages: cloudbeat, aactl, ratify-fips, security-profiles-operator, kyverno, trivy-operator, teleport, cloudbeat-fips, tekton-chains, vexctl, kyverno-fips, trivy, kyverno-notation-aws, slsa-verifier, skaffold-fips, kyverno-notation-aws-fips,...

CVE-2026-73493

Summary: The CVE affects http4s-blaze-server in WebSocket handling where fragmented messages can be aggregated without an upper bound, causing unbounded heap growth and potential DoS via OutOfMemoryError on the Blaze server thread. Affected scope: any http4s application serving WebSocket routes o...

Slips: Behavioral Evidence Aggregation for Network Security

Network intrusion detection systems often analyze individual packets or flows, although malicious behavior may develop across many connections and over time. This may limit their ability to combine isolated detections into a coherent assessment of host behavior. Packet-level features may also be...

CVE-2026-18710

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special...

CVE-2026-18710

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special...

EUVD-2026-57016

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special...

CVE-2026-18710

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special...

CVE-2026-68136

A flaw was found in the Linux kernel's Generic Receive Offload GRO networking subsystem. An attacker could exploit this by sending specially crafted network packets that cause a double aggregation of flush-marked socket buffers skbs. This issue arises from a missing flush check, which allows...

CVE-2026-18707

An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service...