CVE-2026-25610 Invalid $geoNear index hint may cause server crash

An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints...

CVE-2026-25610

An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints...

CVE-2026-21522

Improper neutralization of special elements used in a command 'command injection' in Azure Compute Gallery allows an authorized attacker to elevate privileges locally...

PT-2026-7432

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authorized user can cause a server crash by executing a $geoNear pipeline with specific invalid index hints. The issue involves the use of incorrect index hints within the $geoNear...

MongoDB Server -- CWE-704 Incorrect Type Conversion or Cast

https://jira.mongodb.org/browse/SERVER-113685 reports: An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index...

PT-2026-7438

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index. An unsafe cast in the MongoDB query planner can...

MongoDB Server -- CWE-617 Reachable Assertion

https://jira.mongodb.org/browse/SERVER-99119 reports: An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints...

PT-2026-5605

Name of the Vulnerable Software and Affected Versions MagicINFO 9 Server versions prior to 21.1090.1 Description A flaw exists in MagicINFO 9 Server that permits authorized users to upload HTML files without requiring authentication. This can lead to Stored Cross-Site Scripting XSS, potentially...

CVE-2026-20866

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Management Services allows an authorized attacker to elevate privileges locally...

Windows Hyper-V Information Disclosure Vulnerability

Improper access control in Windows Hyper-V allows an authorized attacker to disclose information locally...

CVE-2021-0170

Exposure of Sensitive Information to an Unauthorized Actor in firmware for some IntelR PROSet/Wireless Wi-Fi in multiple operating systems and some KillerTM Wi-Fi in Windows 10 and 11 may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2021-0001

Observable timing discrepancy in IntelR IPP before version 2020 update 1 may allow authorized user to potentially enable information disclosure via local access...

CVE-2025-64661

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Shell allows an authorized attacker to elevate privileges locally...

Storvsp.sys Driver Denial of Service Vulnerability

Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally...

CVE-2025-11979

An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoD...

CVE-2025-11979

An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoD...

CVE-2025-11979 Use-after-free in the MongoDB server query planner may lead to crash or undefined behavior

An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoD...

EUVD-2025-35086

An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoD...

Mongodb -- Use-after-free in the MongoDB

[email protected] reports: An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions...

CVE-2025-61789

Icinga DB Web (before 1.1.4 and 1.2.3) allows an authorized user to use a custom variable in a filter that is protected or hidden to guess its values; versions 1.1.4 and 1.2.3 return an error when such a variable is used. Affected product: Icinga DB Web; root cause: filter-enumeration of hidden/p...