374056 matches found
CVE-2026-55695
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger performupdate, which passes the URL to update.sh. The updater...
CVE-2026-104005
A security issue was discovered in MongoDB mongos the sharded cluster router where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization...
CVE-2026-103965
An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return...
CVE-2026-104004
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access...
CVE-2026-104004
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access...
UBUNTU-CVE-2026-104004
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access...
CVE-2026-96297
Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory ca...
CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...
CVE-2026-102989
TanStack Router is vulnerable to an unauthenticated reflected XSS in its server-function responses. The root cause involves an attacker placing non-public fields in a server-function request payload, causing attacker-controlled middleware state to reach the error path. This allows a crafted URL t...
CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...
Security Bulletin: IBM WebSphere Application Server Liberty is affected by an authentication bypass (CVE-2026-93909)
Summary IBM WebSphere Application Server Liberty is affected by an authentication bypass with the samlWeb-2.0 enabled. Vulnerability Details CVEID:CVE-2026-93909 DESCRIPTION: IBM WebSphere Application Server Liberty is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature ...
EUVD-2026-98841
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and...
CVE-2026-55695 FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger performupdate, which passes the URL to update.sh. The updater...
CVE-2026-55695
FearlessCMS versions 0.1.2b and earlier are vulnerable to Remote Code Execution via an unvalidated Git repository URL in the system updater. An authenticated administrator can provide an arbitrary URL through admin/updater-handler.php, which is then passed to update.sh. The updater clones this re...
CVE-2026-104005 Incorrect authorization in MongoDB Server router for bulk writes to system namespaces
A security issue was discovered in MongoDB mongos the sharded cluster router where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization...
CVE-2026-104005
A security issue in MongoDB mongos (sharded cluster router) allows an authenticated user with readWrite privileges to cause a Denial of Service (DoS) . By crafting a specially formed aggregation pipeline, an attacker can trigger an unhandled fatal error in an internal aggregation stage that lacks...
CVE-2026-104004 Collection validators using collation-accepting expressions can crash MongoDB Server on insert
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access...
EUVD-2026-98820
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access...
CVE-2026-104004 Collection validators using collation-accepting expressions can crash MongoDB Server on insert
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access...
Collection validators using collation-accepting expressions can crash MongoDB Server on insert
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access...