3940 matches found
MongoDB 8.0.x < 8.0.28 / 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-125872)
The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28, 8.2.x prior to 8.2.12, or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU...
MongoDB 8.3.x < 8.3.7 Aggregation Framework Memory Exhaustion (SERVER-128584)
The version of MongoDB installed on the remote host is 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation...
MongoDB 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-124355)
The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28 or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory,...
MongoDB 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128316)
The version of MongoDB installed on the remote host is 8.2.x prior to 8.2.12 or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and...
MongoDB 8.0.x < 8.0.28 Aggregation Command Invariant Assertion Failure (SERVER-128512)
The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28. It is, therefore, affected by a vulnerability: - An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of...
GHSA-259R-337F-4RFW vulnerabilities
Vulnerabilities for packages: reports-server, zot, elastic-agent-fips, zitadel, nerdctl, backup-restore-operator, omnictl-multiarch-fips, kine, commercial-expanso-edge, kots, kyverno, k3s, terraform, flux, loki, containerd, prometheus-operator, omnictl-multiarch, kaf, aactl, snyk-cli, cert-manage...
CVE-2026-66750
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...
CVE-2026-66750 Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...
PT-2026-65520
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...
Linux Distros Unpatched Vulnerability : CVE-2026-13063
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted...
GHSA-PPR4-5F46-J9C6 Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
Summary When creating a MongoDB datasource, Budibase passes the tlsCertificateKeyFile and tlsCAFile fields straight to the MongoDB driver as server-side file paths. On Budibase Cloud a customer cannot place files on the server, so these fields only let a builder reference arbitrary absolute paths...
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
Summary When creating a MongoDB datasource, Budibase passes the tlsCertificateKeyFile and tlsCAFile fields straight to the MongoDB driver as server-side file paths. On Budibase Cloud a customer cannot place files on the server, so these fields only let a builder reference arbitrary absolute paths...
Information Exposure
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure in the handling of the tlsCertificateKeyFile and tlsCAFile fields, which are passed directly as filesystem paths to the MongoDB driver without validation or restriction. An...
GO-2026-5327 Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver
Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver...
CVE-2026-13065
creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:38+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...
CVE-2026-13064
creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:36+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...
CVE-2026-13063
creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:33+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...
CVE-2026-13062
creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:31+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...