GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: yunikorn-k8shim, dex, rancher, spqr, kyverno-notation-aws, terraform, cert-manager-cmctl, external-secrets-operator, minio, cert-manager, frp, rclone, ratify, cert-manager-csi-driver, xeol, opentofu, k6, flux-source-controller, seaweedfs, grafana, openbao, kyverno,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: yunikorn-k8shim, dex, rancher, spqr, kyverno-notation-aws, terraform, cert-manager-cmctl, external-secrets-operator, minio, cert-manager, frp, rclone, ratify, cert-manager-csi-driver, xeol, opentofu, k6, flux-source-controller, seaweedfs, grafana, openbao, kyverno,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: seaweedfs, rclone, cloudbeat-fips, spqr, yunikorn-k8shim, openbao, ldap2pg, harbor, rancher-agent, harbor-fips, flux-source-controller-fips, opentofu-fips, grafana-fips, gitlab-runner, versitygw, beats-fips, external-secrets-operator, seaweedfs-fips,...

CVE-2026-40351

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

EUVD-2026-23557

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

CVE-2026-40351 FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: emissary, tigera-operator-fips, zarf, k8sgpt-operator, linkerd2, cri-tools, istio-fips, cloudbeat-fips, kots, rancher-agent, trident, cluster-api-fips, cloudnative-pg-fips, dynamic-localpv-provisioner, dynamic-localpv-provisioner-fips, aws-node-termination-handler,...

PT-2026-33519

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, cert-manager-istio-csr-fips, cert-manager-webhook-pdns-fips, mariadb-operator, step-issuer, aws-privateca-issuer, cert-manager-openshift-routes, gitlab-operator, percona-xtradb-cluster-operator-fips, cert-manager-istio-csr,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr, cert-manager-webhook-pdns, step-issuer, cert-manager-csi-driver, mariadb-operator, percona-server-mongodb-operator, opentelemetry-operator, aws-privateca-issuer, cert-manager-cmctl...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr, cert-manager-webhook-pdns, step-issuer, cert-manager-csi-driver, mariadb-operator, percona-server-mongodb-operator, opentelemetry-operator, aws-privateca-issuer, cert-manager-cmctl...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, cert-manager-istio-csr-fips, cert-manager-webhook-pdns-fips, mariadb-operator, step-issuer, aws-privateca-issuer, cert-manager-openshift-routes, gitlab-operator, percona-xtradb-cluster-operator-fips, cert-manager-istio-csr,...

EUVD-2020-23328

Malware in sbrugna...

CVE-2020-35666

Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedosbase.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id$ne=1 value...

Sql injection

Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedosbase.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id$ne=1 value...

PT-2020-19848 · Mongodb · Mongodb Enterprise Kubernetes Operator

Name of the Vulnerable Software and Affected Versions: MongoDB Enterprise Kubernetes Operator versions 1.0 through 1.1 MongoDB Enterprise Kubernetes Operator version 1.2 through 1.2.3 MongoDB Enterprise Kubernetes Operator version 1.3 through 1.3.0 MongoDB Enterprise Kubernetes Operator version 1...