CVE-2026-8336 Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands

After invoking $internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine through $where, $function, mapreduce reduce stage, etc. is used also in...

Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands

After invoking $internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine through $where, $function, mapreduce reduce stage, etc. is used also in...

Post-auth memory exhaustion via bitwise match expressions

An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0 versions prior to...

PT-2026-40810

EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput function's default case in EcclesiaCRM's query view passes user-supplied POST parameters directly into SQL queries via str replace without any sanitization, enabling SQL injection through query parameters...

Claude Code 后置链接漏洞

Claude Code is an open-source terminal-native AI programming tool developed by Anthropic. Versions of Claude Code prior to 1.3834.0 contained a post-installation vulnerability. This vulnerability stemmed from the CoworkVMService component running with SYSTEM privileges and without verifying wheth...

PT-2026-40800

Name of the Vulnerable Software and Affected Versions Quark Drive versions prior to 0.8.5 Description A stored cross-site scripting issue exists in the System Configuration page. The template renders push config key names using the Vue.js v-html directive without proper escaping. Authenticated...

Next.js 安全漏洞

Next.js is a React framework open source by Vercel. Versions of Next.js prior to 15.5.16 and 16.2.5 have a security vulnerability. This vulnerability arises from using the Partial Prerendering feature of Cache Components. A specially crafted POST request to the server can lead to connection...

vm2 后置链接漏洞

vm2 is a high-level virtual machine/sandbox developed by Czech developer Patrik Simek. It runs untrusted code using Node’s built-in modules listed in the allowlist. In version 3.10.5 of vm2, there was a post-installation vulnerability that could lead to remote code execution. This vulnerability...

EcclesiaCRM SQL注入漏洞

EcclesiaCRM is a customer relationship management software for church management, developed by the French individual phili67. Versions of EcclesiaCRM 8.0.0 and earlier had a SQL injection vulnerability. This vulnerability stemmed from the default behavior of the ValidateInput function, which...

WordPress plugin Blog2Social 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

PT-2026-40615

Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key used for payment signature generation. Attackers can extract payment form data and signatures from POST requests to the payment endpoint,...

quark-auto-save 安全漏洞

Quark-auto-save is a personal development tool created by Cp0204, designed for automatic transfer of data to Quark Cloud Storage and management of sign-ins. Versions of quark-auto-save prior to 0.8.5 contained security vulnerabilities. These vulnerabilities stemmed from a batch assignment...

CVE-2026-8052

creationtimestamp| type| source ---|---|--- 2026-05-12 23:50:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mloy5xmzq32c...

CVE-2026-4663

creationtimestamp| type| source ---|---|--- 2026-05-12 23:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlox6jegzl2s...

CVE-2026-44863

creationtimestamp| type| source ---|---|--- 2026-05-12 23:08:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlovsjw4w72k...

CVE-2026-44865

creationtimestamp| type| source ---|---|--- 2026-05-12 23:06:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlovo2iyzu2i...

CVE-2026-44867

creationtimestamp| type| source ---|---|--- 2026-05-12 23:01:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlovg2t4zt2p...

CVE-2026-4301

creationtimestamp| type| source ---|---|--- 2026-05-12 22:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlott7s6ly2i...

CVE-2026-23825

creationtimestamp| type| source ---|---|--- 2026-05-12 22:12:48+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mlosowixs22c...

CVE-2026-32661

creationtimestamp| type| source ---|---|--- 2026-05-12 22:00:00+00:00| seen| https://jvn.jp/en/jp/JVN35567473 2026-05-13 07:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlpru5x5re2y 2026-05-25 23:05:28+00:00| seen|...