3615 matches found
CLEANSTART-2026-DI61732 Security fixes in prometheus-mongodb-exporter 0.47.2-r1
Package prometheus-mongodb-exporter version 0.47.2-r1 fixes 14 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-34986, CVE-2026-24051, CVE-2026-39883, CVE-2026-33186...
CLEANSTART-2026-KI83481 Security fixes in prometheus-mongodb-exporter-fips 0.47.2-r1
Package prometheus-mongodb-exporter-fips version 0.47.2-r1 fixes 14 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-34986, CVE-2026-24051, CVE-2026-39883, CVE-2026-33186...
CLEANSTART-2026-IV17968 Security fixes in mongodb 7.0.32-r1
Package mongodb version 7.0.32-r1 fixes 19 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831...
MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128433)
The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, 8.2.x prior to 8.2.12, or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - An authenticated user with low privileges may be able to perform unauthorized reads and...
MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Improper Access Control (SERVER-127689)
The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, or 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user may be able to view session metadata belonging to other users on the system through the $listSession...
MongoDB 8.0.x < 8.0.28 / 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-125872)
The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28, 8.2.x prior to 8.2.12, or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU...
MongoDB 8.3.x < 8.3.7 Aggregation Framework Memory Exhaustion (SERVER-128584)
The version of MongoDB installed on the remote host is 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation...
MongoDB 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-124355)
The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28 or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory,...
MongoDB 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128316)
The version of MongoDB installed on the remote host is 8.2.x prior to 8.2.12 or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and...
MongoDB 8.0.x < 8.0.28 Aggregation Command Invariant Assertion Failure (SERVER-128512)
The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28. It is, therefore, affected by a vulnerability: - An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of...
GHSA-259R-337F-4RFW vulnerabilities
Vulnerabilities for packages: kine, flux, minio, containerd, snyk-cli, prometheus-operator, kyverno, spire-server, prometheus-mongodb-exporter, telegraf, zitadel, kaf, k3s, backup-restore-operator, nerdctl, cert-manager, terraform, k3d, reports-server, zot, prometheus, kots, loki,...
CVE-2026-66750
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...
CVE-2026-66750 Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...
PT-2026-65520
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...
Information Exposure
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure in the handling of the tlsCertificateKeyFile and tlsCAFile fields, which are passed directly as filesystem paths to the MongoDB driver without validation or restriction. An...
GO-2026-5327 Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver
Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver...
CVE-2026-13065
creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:38+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...
CVE-2026-13064
creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:36+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...