CVE-2026-73226

CVE-2026-73226 affects electerm prior to version 3.15.186. An authenticated WebSocket client could invoke unintended internal functions via client-controlled func values in upgrade-func (src/app/server/dispatch-center.js) and handleFs (src/app/server/fs.js), exposing Upgrade and fsExport methods ...

CVE-2026-18702

An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring...

Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure

An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memo...

CVE-2026-18694 Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure

An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memo...

CVE-2026-18694

CVE-2026-18694 affects MongoDB Server geospatial query processing. An authenticated user with write privileges can store malformed geometry data that is later processed without validation, causing out-of-bounds memory access, a server crash (DoS), and potential memory exposure. The vulnerability ...

CVE-2026-18694

An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memo...

Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could...

CVE-2026-18700 Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service

An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result ...

EUVD-2026-56913

An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result ...

Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service

An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result ...

CVE-2026-18700

An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result ...

Type Confusion in MongoDB Query Subsystem Leads to Denial of Service

An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service...

EUVD-2026-56909

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server...

Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server...

CVE-2026-18693

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server...

CVE-2026-18693

CVE-2026-18693 involves MongoDB Server handling of timeseries collections. The issue arises when an authenticated user with write privileges inserts certain documents, which can cause an internal data structure to become inconsistent. A subsequent insert into the affected bucket may trigger memor...

EUVD-2026-56908

An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructin...

CVE-2026-18705

An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructin...

CVE-2026-18705

Summary: CVE-2026-18705 affects MongoDB Server’s Atlas Vector Search feature. An authenticated user with read access to one view can retrieve documents from a different, protected view on the same underlying collection. Root cause (as stated): Insufficient handling of certain user-supplied fields...

CVE-2026-18704

An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an...