CVE-2026-18954 Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode...

CVE-2026-18954

CVE-2026-18954 : Affected product is Amazon AWS Labs DocumentDB MCP Server prior to 1.0.12. The issue is incorrect authorization in the aggregation pipeline tool that could allow a authenticated MCP client to perform write operations via write-capable aggregation pipeline stages, bypassing the re...

CVE-2026-18954 Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode...

CVE-2026-18954: Incorrect Authorization

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode...

PT-2026-68312

Name of the Vulnerable Software and Affected Versions Amazon AWS Labs DocumentDB MCP Server versions prior to 1.0.12 Description Incorrect authorization in the aggregation pipeline tool allows an authenticated MCP client to perform unauthorized write operations on the connected database. This...

netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by repeatedly closing Redis pipeline connections before a Redis array aggregate completes. This leads to a permanent leak of direct-memory buffers, which prevents memory chunks from being returned to the share...

DHMark: Public-Key Watermarking for LLM-Generated Text Via Diffie-Hellman-Guided Rejection Sampling

Large language model LLM watermarking provides an important mechanism for tracing the provenance of generated text. Existing statistical watermarks are often effective and robust, but most of them rely on private detection keys, which centralizes verification and complicates public auditing. Rece...

Security Bulletin: IBM WebSphere Automation is vulnerable to multiple CVEs affecting multiple mongo packages within MongoDB

Summary IBM WebSphere Automation is vulnerable to multiple CVEs affecting the mongod, mongodb & mongos packages within MongoDB. Vulnerability Details CVEID:CVE-2026-8053 DESCRIPTION: An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database writ...

MongoDB 8.3.x < 8.3.7 Aggregation Framework Memory Exhaustion (SERVER-128584)

The version of MongoDB installed on the remote host is 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation...

MongoDB 8.0.x < 8.0.28 Aggregation Command Invariant Assertion Failure (SERVER-128512)

The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28. It is, therefore, affected by a vulnerability: - An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of...

MongoDB 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128316)

The version of MongoDB installed on the remote host is 8.2.x prior to 8.2.12 or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and...

MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128433)

The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, 8.2.x prior to 8.2.12, or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - An authenticated user with low privileges may be able to perform unauthorized reads and...

Linux Distros Unpatched Vulnerability : CVE-2026-13075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregati...

Linux Distros Unpatched Vulnerability : CVE-2026-13073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in deni...

Linux Distros Unpatched Vulnerability : CVE-2026-13077

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of- bounds heap read via a crafted aggregation pipeline. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-13076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion...

Linux Distros Unpatched Vulnerability : CVE-2026-13063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted...

EUVD-2026-48802

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damonhotscore Fix three issues in damonhotscore that comes from wrong handling of extreme zero or too high monitoring intervals user setup. When the user sets sampling interval zer...

CVE-2026-64458 mm/damon/ops-common: handle extreme intervals in damon_hot_score()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damonhotscore Fix three issues in damonhotscore that comes from wrong handling of extreme zero or too high monitoring intervals user setup. When the user sets sampling interval zer...

PT-2026-64679

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Three issues exist in the damon hot score function due to improper handling of extreme monitoring intervals configured by the user. If the sampling interval is set to zero, the damon max...