7182 matches found
Malicious code in cortana-md-engine (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a2de4b6992a1dd7177803253b8c214d1ba7cc911cf0e1e7f800e1e9ff7ab5b1 cortana-md-engine is a Baileys-based WhatsApp bot whose bundled entrypoints dist/hosted.cjs and dist/index.cjs hardcode five...
RHEL 8 : ruby:2.5 (RHSA-2026:73519)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73519 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...
Important: ruby:2.5 security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 rubygem-mongo:...
BIT-MONGODB-2026-18712 Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...
BIT-MONGODB-2026-18711 Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure
An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server...
PT-2026-99984
An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server...
PT-2026-99985
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...
SUSE CVE-2026-96747
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...
SUSE CVE-2026-96749
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...
BIT-MONGODB-2026-8843 Calling createIndex with certain index types can crash mongod
Creating a "2dspherebucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryableencryptedrange" indices. This issue affects MongoDB Server...
CVE-2026-96744
creationtimestamp| type| source ---|---|--- 2026-09-25 02:09:18+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-6...
CVE-2026-96748
creationtimestamp| type| source ---|---|--- 2026-09-25 02:09:18+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-6 2026-09-28 08:45:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweseq6t2f 2026-10-06 09:30:32+00:00| seen|...
CVE-2026-96750
creationtimestamp| type| source ---|---|--- 2026-09-25 02:09:18+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-6...
CVE-2026-88032
A flaw was found in the MongoDB Java Driver. A use-after-free vulnerability in the reactive client-side encryption component can occur when an encrypted operation is cancelled. An attacker able to cause such an operation to be cancelled may cause the hosting application process to terminate. This...
Linux Distros Unpatched Vulnerability : CVE-2026-96747
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in .sock as a local Unix domain...
MongoDB Aggregation DoS
The vulnerability of the aggregation merging mechanism between shards in the MongoDB database management system is related to an uncontrolled and exploitable condition. Exploiting this vulnerability could allow a malicious actor to cause service failures...
MongoDB DoS
The vulnerability of the bit expression processing mechanisms $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear in the MongoDB database management system is related to improper handling of sequential memory allocation. Exploiting this vulnerability can allow an attacker to cause service...
MongoDB BSON Document Verification DoS
The vulnerability of the BSON document verification mechanism in the MongoDB database management system is related to an uncontrolled recursion. Exploiting this vulnerability can allow a malicious actor to cause service failures...
MongoDB ldapQueryPassword Unauthorized Access
The vulnerability of the ldapQueryPassword parameter processing mechanism in the MongoDB database management system is related to the disclosure of information through registration files. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...
MongoDB Collection Schema Unauthorized Access
The vulnerability of the journal message formation mechanism, when checking the schema of the MongoDB database management system’s collection, is related to the disclosure of information through registration files. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...