2591 matches found
UBUNTU-CVE-2026-13076
An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...
CVE-2026-13058 Transaction Command Insufficient Input Validation Leading to Process Termination
An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fat...
EUVD-2026-47777
An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fat...
CVE-2026-13058
This CVE affects MongoDB’s mongod process. An authenticated user with basic write privileges can send a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, which can trigger a fatal inte...
EUVD-2026-47799
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...
CVE-2026-13076
CVE-2026-13076 describes memory-exhaustion in MongoDB’s aggregation framework causing a mongod process termination under memory pressure. An authenticated user with write access and ability to run aggregation queries can trigger disproportionate memory consumption via a specific data type convers...
EUVD-2026-47785
An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...
CVE-2026-13076
An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...
Aggregation Framework Memory Exhaustion Leading to Process Termination
An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...
PT-2026-63480
An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...
CVE-2026-60351
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware component: ADF Faces. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper...
EUVD-2026-41636
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write...
GHSA-W5PG-649R-P6GG Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Summary Gitea does not re-evaluate the official flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access to a repository can obtain an official: true approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch e.g.,...
CVE-2026-55550
NextCRM is open-source customer relationship management CRM software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to manager and admin roles. However, in version 0.12.1, the MCP product tools...
CVE-2026-55544
NextCRM is open-source customer relationship management CRM software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens nxtc.... The application has an authorization model that restricts normal users to...
sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation
A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...
CVE-2026-15783
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to read metadata from private repositories they did not have access to, including private repository owners and names, branch names, commit SHAs,...
CVE-2026-15783
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to read metadata from private repositories they did not have access to, including private repository owners and names, branch names, commit SHAs,...
CVE-2026-15783 Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to read metadata from private repositories they did not have access to, including private repository owners and names, branch names, commit SHAs,...
CVE-2026-15783 Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to read metadata from private repositories they did not have access to, including private repository owners and names, branch names, commit SHAs,...