CVE-2026-82073 Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...

CVE-2026-82073

MongoDB Server aggregation framework is affected by an improper validation vulnerability (CVE-2026-82073). When Atlas Search features are in use, an authenticated user with limited read privileges can bypass view-level authorization checks and read data from unauthorized collections by manipulati...

CVE-2026-82071

MongoDB Server is affected by an insufficient validation issue in storage engine configuration options. An authenticated user with write privileges can supply crafted parameters during collection creation that override internal storage metadata, resulting in an out-of-bounds memory write in the s...

EUVD-2026-72915

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process...

Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process...

CVE-2026-82071 Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process...

CVE-2026-82065

CVE-2026-82065 affects the MongoDB Server storage engine integration layer. An authenticated user with collection creation privileges can supply malformed storage configuration options that bypass validation and are persisted to durable metadata. When that metadata is later read by diagnostic ope...

EUVD-2026-72952

A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable...

CVE-2026-82057

MongoDB is affected by a type confusion in its WiredTiger storage engine . An authenticated user with readWrite privileges can specify a custom WiredTiger storage configuration option with an incompatible value during collection creation. When documents are subsequently read from the misconfigure...

EUVD-2026-72944

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...

Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...

CVE-2026-82057 Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...

PT-2026-87164

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process...

Linux Distros Unpatched Vulnerability : CVE-2026-18712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause...

CVE-2026-86283 MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

MISP's UiBeta theme collection view app/View/Themed/UiBeta/Collections/view.ctp performed a secondary query of member events by UUID without applying the caller's access control list ACL. The CollectionsController::view action correctly resolved collection element UUIDs through...

CVE-2026-86283

MISP 's UiBeta theme collection view template (app/View/Themed/UiBeta/Collections/view.ctp) contained an authorization bypass : while the controller correctly enforced per-user event ACL via Event::fetchSimpleEvents(), the view independently re-queried the same event UUIDs using only an Event.uui...

CVE-2026-86283 MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

MISP's UiBeta theme collection view app/View/Themed/UiBeta/Collections/view.ctp performed a secondary query of member events by UUID without applying the caller's access control list ACL. The CollectionsController::view action correctly resolved collection element UUIDs through...

CVE-2026-86090

creationtimestamp| type| source ---|---|--- 2026-09-06 06:11:54+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mutdkg5dke2l 2026-09-06 07:07:56+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mutgolfbcq2x 2026-09-10 03:30:04+00:00| seen|...

CVE-2026-85689

llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer llmware/resources.py where filter and lookup values are directly string-interpolated into SQL WHERE clauses without parameterization or escaping, in both the SQLite and PostgreSQL backends. The filter validator...

CVE-2026-85689

llmware 0.4.6 contains an SQL injection vulnerability in its collection-database layer (llmware/resources.py). Filter and lookup values are directly string-interpolated into SQL WHERE clauses without parameterization or escaping, affecting both the SQLite and PostgreSQL backends. The filter valid...