PT-2026-63481

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A missing bounds check in the BSON CodeWScope element accessors enables an authenticated user to trigger an out-of-bounds heap read through a crafted aggregation...

PT-2026-63459

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user with permissions to execute aggregation pipelines can cause a MongoDB server mongod to crash. This occurs when the $ internalIndexKey aggregation expression is used with...

CVE-2026-13065: NULL Pointer Dereference

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...

CVE-2026-13063: Integer Overflow or Wraparound

An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively larg...

PT-2026-63482

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description The server-side MozJS scripting engine unconditionally registers a module loading hook. This allows JavaScript calls to read arbitrary files from the host filesystem using the privileg...

CVE-2026-13055: Reachable Assertion

The $internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server mongod. The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an...

PT-2026-63467

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user with standard read/write privileges can cause the mongod process to terminate by sending a crafted aggregation command. This occurs because the libmongocrypt library...

CVE-2026-13072: Heap-based Buffer Overflow

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default...

CVE-2026-13071: Use After Free

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing...

bbscope — Updated!

bbscope.com Web interface and API for aggregating bug bounty program scopes from HackerOne, Bugcrowd, Intigriti, and YesWeHack. Quick start Docker root@kitploit: cd website cp .env.example .env Edit .env — at minimum set POSTGRESPASSWORD and your platform credentials docker compose up -d --build...

batman-adv: v: prevent OGM aggregation on disabled hardif

...

SUSE CVE-2026-63835

In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: prevent OGM aggregation on disabled hardif When an interface gets disabled, the worker is correctly disabled by batadvhardifdisableinterface - ... - batadvvogmifacedisable. In this process, the skb aggrlist is also...

CVE-2026-63835

In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: prevent OGM aggregation on disabled hardif When an interface gets disabled, the worker is correctly disabled by batadvhardifdisableinterface - ... - batadvvogmifacedisable. In this process, the skb aggrlist is also...

CVE-2026-63835

In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: prevent OGM aggregation on disabled hardif When an interface gets disabled, the worker is correctly disabled by batadvhardifdisableinterface - ... - batadvvogmifacedisable. In this process, the skb aggrlist is also...

CVE-2026-63835 batman-adv: v: prevent OGM aggregation on disabled hardif

In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: prevent OGM aggregation on disabled hardif When an interface gets disabled, the worker is correctly disabled by batadvhardifdisableinterface - ... - batadvvogmifacedisable. In this process, the skb aggrlist is also...

CVE-2026-63835

CVE-2026-63835 concerns the Linux kernel’s batman-adv OGM aggregation on disabled hard interfaces. When an interface is disabled, batadv_hardif_disable_interface() disables the worker and frees the skb aggr_list; however batadv_v_ogm_send_meshif() may still queue new skbs via batadv_v_ogm_queue_o...

CVE-2026-63835 batman-adv: v: prevent OGM aggregation on disabled hardif

In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: prevent OGM aggregation on disabled hardif When an interface gets disabled, the worker is correctly disabled by batadvhardifdisableinterface - ... - batadvvogmifacedisable. In this process, the skb aggrlist is also...

CVE-2026-63835

In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: prevent OGM aggregation on disabled hardif When an interface gets disabled, the worker is correctly disabled by batadvhardifdisableinterface - ... - batadvvogmifacedisable. In this process, the skb aggrlist is also...

Securing Autonomous Vehicle Systems Via Twin-Aware Federated Reinforcement Learning

Federated reinforcement learning FRL is crucial for enabling collaborative learning across multiple agents without sharing raw data, thereby enhancing privacy and scalability in the decision-making process within dynamic vehicular environments. However, poisoning attacks pose a significant threat...

ROS-20260707-73-0024

The vulnerability of the system’s application programming interface for aggregating and storing Loki logs is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protecte...