Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process...

CVE-2026-82065

CVE-2026-82065 affects the MongoDB Server storage engine integration layer. An authenticated user with collection creation privileges can supply malformed storage configuration options that bypass validation and are persisted to durable metadata. When that metadata is later read by diagnostic ope...

EUVD-2026-72952

A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable...

CVE-2026-82057

MongoDB is affected by a type confusion in its WiredTiger storage engine . An authenticated user with readWrite privileges can specify a custom WiredTiger storage configuration option with an incompatible value during collection creation. When documents are subsequently read from the misconfigure...

EUVD-2026-72944

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...

CVE-2026-82057 Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...

CVE-2026-82057 Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...

CVE-2026-82057 Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...

Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...

PT-2026-87150

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user with readWrite privileges can crash the mongod server process. This occurs when a custom WiredTiger storage configuration option is specified with an incompatible value...

PT-2026-87166

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An incorrect authorization issue exists within the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that tricks...

CVE-2026-82057: Access of Resource Using Incompatible Type

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...

PT-2026-87164

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description Insufficient validation of storage engine configuration options allows an authenticated user with write privileges to provide crafted parameters during collection creation. This action...

CVE-2026-82071: Out-of-bounds Write

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process...

Linux Distros Unpatched Vulnerability : CVE-2026-18712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause...

CVE-2026-86283 MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

MISP's UiBeta theme collection view app/View/Themed/UiBeta/Collections/view.ctp performed a secondary query of member events by UUID without applying the caller's access control list ACL. The CollectionsController::view action correctly resolved collection element UUIDs through...

CVE-2026-86283 MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

MISP's UiBeta theme collection view app/View/Themed/UiBeta/Collections/view.ctp performed a secondary query of member events by UUID without applying the caller's access control list ACL. The CollectionsController::view action correctly resolved collection element UUIDs through...

CVE-2026-86283

MISP 's UiBeta theme collection view template (app/View/Themed/UiBeta/Collections/view.ctp) contained an authorization bypass : while the controller correctly enforced per-user event ACL via Event::fetchSimpleEvents(), the view independently re-queried the same event UUIDs using only an Event.uui...

cves-collection

cve-colle...

CVE-2026-86090

creationtimestamp| type| source ---|---|--- 2026-09-06 06:11:54+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mutdkg5dke2l 2026-09-06 07:07:56+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mutgolfbcq2x 2026-09-10 03:30:04+00:00| seen|...