CLEANSTART-2026-WA48911 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Multiple security vulnerabilities affect the percona-server-mongodb-operator package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: ratify, cert-manager-csi-driver, opentofu, rclone, zot, spqr, cert-manager-istio-csr, percona-server-mongodb-operator, telegraf, teleport, rancher-webhook, gitlab-runner, flux, grafana, dex, kyverno-notation-aws, k6, rancher, frp, openbao, gitea, seaweedfs, minio,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: ratify, cert-manager-csi-driver, opentofu, rclone, zot, spqr, cert-manager-istio-csr, percona-server-mongodb-operator, telegraf, teleport, rancher-webhook, gitlab-runner, flux, grafana, dex, kyverno-notation-aws, k6, rancher, frp, openbao, gitea, seaweedfs, minio,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-runner-fips, nuclei, beats-fips, rancher-webhook-fips, telegraf, packer-fips, trufflehog, ldap2pg, dex, cert-manager-fips, rclone, zot, cert-manager-csi-driver-fips, cert-manager-openshift-routes, seaweedfs, flux, yunikorn-k8shim-fips,...

CVE-2026-40351

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

CVE-2026-40351 FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

EUVD-2026-23557

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: gpu-operator, cloudnative-pg-fips, gitlab-runner, gitlab-runner-fips, verticadb-operator, k8s-driver-manager, terraform-provider-kubernetes-fips, istio-fips, rke2-runtime, datadog-agent-fips, gpu-operator-fips, kubescape, postgres-operator, headlamp-fips,...

PT-2026-33519

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: percona-xtradb-cluster-operator, mariadb-operator, mariadb-operator-fips, opentelemetry-operator-fips, cert-manager-istio-csr-fips, cert-manager-csi-driver, cert-manager-cmctl-fips, percona-server-mongodb-operator-fips, aws-privateca-issuer-fips, step-issuer-fips,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, cert-manager-webhook-pdns, cert-manager-csi-driver, cert-manager-istio-csr, percona-server-mongodb-operator, mariadb-operator, opentelemetry-operator, aws-privateca-issuer, step-issuer...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, cert-manager-webhook-pdns, cert-manager-csi-driver, cert-manager-istio-csr, percona-server-mongodb-operator, mariadb-operator, opentelemetry-operator, aws-privateca-issuer, step-issuer...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: percona-xtradb-cluster-operator, mariadb-operator, mariadb-operator-fips, opentelemetry-operator-fips, cert-manager-istio-csr-fips, cert-manager-csi-driver, cert-manager-cmctl-fips, percona-server-mongodb-operator-fips, aws-privateca-issuer-fips, step-issuer-fips,...

EUVD-2020-23328

Malware in sbrugna...

CVE-2020-35666

Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedosbase.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id$ne=1 value...

Sql injection

Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedosbase.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id$ne=1 value...

PT-2020-19848 · Mongodb · Mongodb Enterprise Kubernetes Operator

Name of the Vulnerable Software and Affected Versions: MongoDB Enterprise Kubernetes Operator versions 1.0 through 1.1 MongoDB Enterprise Kubernetes Operator version 1.2 through 1.2.3 MongoDB Enterprise Kubernetes Operator version 1.3 through 1.3.0 MongoDB Enterprise Kubernetes Operator version 1...