VulnCheck KEV: CVE-2026-90898

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...

Linux Distros Unpatched Vulnerability : CVE-2026-101770

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Client programs. Supported versions that are affected are MySQL Server:...

metasploit-ldapnightmare

metasploit-ldapnightmare SafeBreaches CVE-2024-49113 POCLdapNightmare Integrated into Metasploit Overview This module implements CVE-2024-49113, a critical vulnerability in the Windows LDAP client that can cause system instability. The module integrates with the Metasploit Framework, providing a...

CVE-2026-115424

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a...

CVE-2026-101772

A flaw was found in the Client programs component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for component-specific impact...

CVE-2026-101771

A flaw was found in the Client programs component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for component-specific impact...

CVE-2026-101770

A flaw was found in the Client programs component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for component-specific impact...

CVE-2026-101679

A flaw was found in the Client programs component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for component-specific impact...

CVE-2026-115424

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a...

CVE-2026-114653

A client-side encryption schema construction component in the MongoDB C Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side...

CVE-2026-114649

The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...

CVE-2026-114650

A flaw in the client-side encryption support of the MongoDB .NET/C driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer...

EUVD-2026-108325

A client-side encryption schema construction component in the MongoDB C Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side...

CVE-2026-114650 Plaintext exposure of encrypted fields via ANSI code-page corruption of database name

A flaw in the client-side encryption support of the MongoDB .NET/C driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer...

CVE-2026-114650

A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause sensitive data designated for client-side field-level encryption to be written in plaintext . Under specific platform text-encoding configurations, an internal name conversion loses information, causing the encry...

EUVD-2026-108319

A flaw in the client-side encryption support of the MongoDB .NET/C driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer...

CVE-2026-114650 Plaintext exposure of encrypted fields via ANSI code-page corruption of database name

A flaw in the client-side encryption support of the MongoDB .NET/C driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer...

CVE-2026-114649 Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache

The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...

EUVD-2026-108317

The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...

CVE-2026-114649 Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache

The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...